Ran across this and it took me a while because of the dot notation that they are using in the path, seems you can just ignore it and use it as part of the path.

<quer:filtering xmlns:quer="http://www.taleo.com/ws/integration/query">
<quer:or>
<quer:equal>
<quer:field path="Candidate,History,ApplicationTrackingHistoryItem.CreationDate"/>
<quer:query projectedClass="Application" alias="histItemSubQuery">
<quer:projections>
<quer:projection>
<quer:maximum>
<quer:field path="Candidate,History,ApplicationTrackingHistoryItem.CreationDate"/>
</quer:maximum>
</quer:projection>
</quer:projections>
<quer:filterings>
<quer:filtering>
<quer:equal>
<quer:field ownerQuery="histItemSubQuery" path="Number"/>
<quer:field ownerQuery="NewHire" path="Number"/>
</quer:equal>
</quer:filtering>
</quer:filterings>
</quer:query>
</quer:equal>
<quer:isNull>
<quer:field path="Candidate,History,ApplicationTrackingHistoryItem.CreationDate"/>
</quer:isNull>
</quer:or>
</quer:filtering>

I recently came upon a situation where we needed the start date but because the offer module not being used, we needed to get it from the history.

Here is where it lives:
Candidate,History,ApplicationTrackingHistoryItem.Detail

and you have to filter on the event code:
Candidate,History,ApplicationTrackingHistoryItem.Event,Code