It seems the problem is that at index time splunk creates a digital signature. This signature takes in to account the event, its time stamp and previously indexed events for that indexer.
At search time, splunk compares these with the events it retrieves but if you have distributed search on, events form another indexer may be merged together. Their signatures will not match and they will show out of sequence.
This is aggravated if you are using load balancing as the data will always be split on different indexers.
If splunk ignored this, you could easily fool it that data was valid by sending an out of sequence event to a secondary indexer.
Bob
