topic Re: Sort returning different results? in Splunk Search

Sort returning different results?

questionsdaniel — Tue, 24 Jun 2025 17:34:38 GMT

Hi, I'm attempting to write a search where I return a top 10 of a value. However, I am noticing that I return different top 10's when I rerun the search. Does this happen to anyone else?

Re: Sort returning different results?

livehybrid — Tue, 24 Jun 2025 19:00:06 GMT

Hi @questionsdaniel

Are you re-running it against the exact same earliest/latest time?

Also - the top command can only process the first 50,000 results - so its likely that the first 50,000 events returned from your indexers are different each time (arrive in a different order for example) which is why you see different values.

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Sort returning different results?

richgalloway — Tue, 24 Jun 2025 19:11:10 GMT

Are you using the exact same time span each time? That is, not '-24h', but "2025-06-23:15:10:00".

Please share your SPL.