[BUG] rum sessions: --from relative time not converted, causes 400

[acushner-rippling]

Describe the bug

pup rum sessions search and pup rum sessions list pass the --from flag value directly to the Datadog API without converting it. The default value "1h" is not a valid time format for the RUM API, so the commands always fail with 400 unless the user manually writes "now-1h".

The logs commands handle this correctly — they run the same "1h" value through parseTimeString() which converts it to a millisecond timestamp. The RUM sessions commands skip this step.

To Reproduce

# fails (default --from value)
pup rum sessions search --query "@type:view" --from "1h" --limit 3

# also fails (explicit)
pup rum sessions list --from "1h" --limit 3

Error: failed to search RUM sessions: 400 Bad Request (status: 400)

Workaround

Use date math notation instead of bare relative time:

# works
pup rum sessions search --query "@type:view" --from "now-1h" --limit 3

Root cause

In cmd/rum.go, runRumSessionsList and runRumSessionsSearch pass the raw --from flag value to RUMQueryFilter.From:

body := datadogV2.RUMSearchEventsRequest{
    Filter: &datadogV2.RUMQueryFilter{
        From: &rumFrom,    // sends "1h" directly — invalid
        To:   &rumTo,
    },
}

The RUM API expects from to be one of:

• date math: "now-1h"
• ISO 8601: "2024-01-15T10:00Z"
• unix milliseconds: "1705312800000"

Compare with cmd/logs_simple.go which correctly converts via parseTimeString():

fromTime, err := parseTimeString(logsFrom)  // "1h" -> millisecond timestamp
from := fmt.Sprintf("%d", fromTime)

Suggested fix

Either reuse parseTimeString() for RUM commands, or convert "1h" to "now-1h" before passing to the API. The latter is simpler since the RUM API natively supports date math.

Note: the CLI default ("1h") and help text both imply this format should work, matching the logs commands' behavior.

Environment

• OS: macOS
• Pup version: dev (via go install github.com/DataDog/pup@latest)
• Go version: 1.24.0
• Authentication method: API keys (DD_API_KEY / DD_APP_KEY)