Splunk Search

Sort returning different results?

questionsdaniel
Observer

Hi, I'm attempting to write a search where I return a top 10 of a value. However, I am noticing that I return different top 10's when I rerun the search. Does this happen to anyone else? 

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Are you using the exact same time span each time?  That is, not '-24h', but "2025-06-23:15:10:00".

Please share your SPL.

---
If this reply helps you, Karma would be appreciated.

livehybrid
SplunkTrust
SplunkTrust

Hi @questionsdaniel 

Are you re-running it against the exact same earliest/latest time?

Also - the top command can only process the first 50,000 results - so its likely that the first 50,000 events returned from your indexers are different each time (arrive in a different order for example) which is why you see different values.

🌟 Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...