The problem here is that _time is considered to be an internal field, and as such won't get picked up by the format command that is implicitly run by the subsearch, so it will not be included in the subsearch output. However using a little workaround we can get the output we want anyway, by creating a field called query which will contain the _time filtering string. query is a special field whose value is returned from the subsearch as-is rather than Splunk adding "query=" before it. [search yoursubsearch | eval query="_time="._time | fields query] ... View more