One problem here is that _time is considered to be an internal field, and as such won't get picked up by the format command that is implicitly run by the subsearch. So the output will only contain the source parts.
Another problem is that the subsearch will by default only have key=value formatted output, not any equalities like "_time>somevalue". These problems can however be solved using a hack to get the output we want anyway, by creating a field called query which will contain the _time filtering string. query is a special field whose value is returned from the subsearch as-is rather than Splunk adding "query=" before it.
Assuming you have the sourcetype "web_log", the query could look something like this:
sourcetype=web_log file_extension=xap OR file_extension=php [search sourcetype=web_log file_extension=swf | eval query="_time>"._time." AND _time<"._time+60 | fields dst_hostname query]
