https://community.splunk.com/t5/Getting-Data-In/Time-manipulation-doesn-t-work/m-p/65555#M13170 <P>My query runs for the past week and I want to append to sets of results from 2 different date ranges. What is my mistake?</P> <P>eventId="43330100000002004" | convert timeformat="%m/%d/%y %H:%M:%S" ctime(_time) as "new_t" |search "join room success" earliest="02/04/2012 12:00:00" latest="02/05/2012 12:00:00"</P> Mon, 28 Sep 2020 10:23:37 GMT Yarsa 2020-09-28T10:23:37Z https://community.splunk.com/t5/Getting-Data-In/Time-manipulation-doesn-t-work/m-p/65555#M13170 <P>My query runs for the past week and I want to append to sets of results from 2 different date ranges. What is my mistake?</P> <P>eventId="43330100000002004" | convert timeformat="%m/%d/%y %H:%M:%S" ctime(_time) as "new_t" |search "join room success" earliest="02/04/2012 12:00:00" latest="02/05/2012 12:00:00"</P> Mon, 28 Sep 2020 10:23:37 GMT https://community.splunk.com/t5/Getting-Data-In/Time-manipulation-doesn-t-work/m-p/65555#M13170 Yarsa 2020-09-28T10:23:37Z https://community.splunk.com/t5/Getting-Data-In/Time-manipulation-doesn-t-work/m-p/65556#M13171 <P>FIrst, the time format in the earliest and latest is wrong. It should be</P> <PRE><CODE> earliest="02/04/2012:12:00:00" latest="02/05/2012:12:00:00" </CODE></PRE> <P>Also, the search command on the second line does not run an independent search. The search command searches within the previous search results. You may want to use the append command instead. For example</P> <PRE><CODE>eventId="43330100000002004" | convert timeformat="%m/%d/%y %H:%M:%S" ctime(_time) as "new_t" | append [search "join room success" earliest="02/04/2012:12:00:00" latest="02/05/2012:12:00:00"] </CODE></PRE> Tue, 07 Feb 2012 05:07:56 GMT https://community.splunk.com/t5/Getting-Data-In/Time-manipulation-doesn-t-work/m-p/65556#M13171 lguinn2 2012-02-07T05:07:56Z