Hi, I'm attempting to write a search where I return a top 10 of a value. However, I am noticing that I return different top 10's when I rerun the search. Does this happen to anyone else?
Are you using the exact same time span each time? That is, not '-24h', but "2025-06-23:15:10:00".
Please share your SPL.
Are you re-running it against the exact same earliest/latest time?
Also - the top command can only process the first 50,000 results - so its likely that the first 50,000 events returned from your indexers are different each time (arrive in a different order for example) which is why you see different values.
🌟 Did this answer help you? If so, please consider:
Your feedback encourages the volunteers in this community to continue contributing