Got this question today from someone who needs to reverse the order of the search results for their troubleshooting purposes.
By default, Splunk displays your search results from most recent to oldest. You can reverse the order by appending your search with '| reverse'. For example:
sourcetype=foo | reverse
Try it. You'll find that sort - _time doesn't deal with events that have the same time stamp in the same way as reverse. Reverse literally flips the event stream top to bottom, but the sort might leave "simultaneous" events in the original "new stuff on top" order. This is probably only meaningful if you have an event stream that is part of a transaction, and you're used to reading it in "log" order.