Time manipulation doesn't work

[Yarsa]

My query runs for the past week and I want to append to sets of results from 2 different date ranges. What is my mistake?

eventId="43330100000002004" | convert timeformat="%m/%d/%y %H:%M:%S" ctime(_time) as "new_t" |search "join room success" earliest="02/04/2012 12:00:00" latest="02/05/2012 12:00:00"

[lguinn2 · Accepted solution]

FIrst, the time format in the earliest and latest is wrong. It should be

 earliest="02/04/2012:12:00:00" latest="02/05/2012:12:00:00"

Also, the search command on the second line does not run an independent search. The search command searches within the previous search results. You may want to use the append command instead. For example

eventId="43330100000002004" | convert timeformat="%m/%d/%y %H:%M:%S" ctime(_time) as "new_t" |
append [search "join room success" earliest="02/04/2012:12:00:00" latest="02/05/2012:12:00:00"]