https://community.splunk.com/t5/Splunk-Search/Why-is-sorting-by-time-reducing-the-number-of-my-search-results/m-p/183917#M52956 <P>I made a search over two indexes (OR connected) and five sourcetypes (OR connected), limited the time to two days and received 26,300 events. Now I pipe this to a sort _time and suddenly only 10,000 of 26,300 events match? </P> <P>What is wrong here? Since when does sorting filter results?</P> <P>Example:</P> <PRE><CODE>index="index-one" OR index="index-two" sourcetype="sourcetype-one" OR sourcetype="sourcetype-two" OR sourcetype="sourcetype-three" OR sourcetype="sourcetype-four" OR sourcetype="sourcetype-five" | sort _time </CODE></PRE> Tue, 28 Oct 2014 08:44:08 GMT ulrich_track 2014-10-28T08:44:08Z https://community.splunk.com/t5/Splunk-Search/Why-is-sorting-by-time-reducing-the-number-of-my-search-results/m-p/183917#M52956 <P>I made a search over two indexes (OR connected) and five sourcetypes (OR connected), limited the time to two days and received 26,300 events. Now I pipe this to a sort _time and suddenly only 10,000 of 26,300 events match? </P> <P>What is wrong here? Since when does sorting filter results?</P> <P>Example:</P> <PRE><CODE>index="index-one" OR index="index-two" sourcetype="sourcetype-one" OR sourcetype="sourcetype-two" OR sourcetype="sourcetype-three" OR sourcetype="sourcetype-four" OR sourcetype="sourcetype-five" | sort _time </CODE></PRE> Tue, 28 Oct 2014 08:44:08 GMT https://community.splunk.com/t5/Splunk-Search/Why-is-sorting-by-time-reducing-the-number-of-my-search-results/m-p/183917#M52956 ulrich_track 2014-10-28T08:44:08Z https://community.splunk.com/t5/Splunk-Search/Why-is-sorting-by-time-reducing-the-number-of-my-search-results/m-p/183918#M52957 <P>Hi,</P> <P>sort is limited to 10000 results. Use this:</P> <PRE><CODE>| sort limit=0 _time </CODE></PRE> <P>or just</P> <PRE><CODE>| sort 0 _time </CODE></PRE> <P>Greetings</P> <P>Tom</P> Tue, 28 Oct 2014 08:52:20 GMT https://community.splunk.com/t5/Splunk-Search/Why-is-sorting-by-time-reducing-the-number-of-my-search-results/m-p/183918#M52957 tom_frotscher 2014-10-28T08:52:20Z