Why does _time bucket give different results depending on how the data is sorted?

[manus]

The following search returns two values (yesterday (1430780400) and today(1430866800)):
earliest=-d@d index=_internal
| bucket _time span=1d
| stats values(_time)

This search returns only one value (yesterday(1430780400)):
earliest=-d@d index=_internal
| sort _time
| bucket _time span=1d
| stats values(_time)

So sorting by _time affects the results of "bucket _time span=1d".
That looks like an undesired feature to me.

[HeinzWaescher · Accepted solution]

How many events are searched for? I think the sort command you are using only uses 10k events.

Try this

 | sort 0 _time

[manus]

Thanks a lot, spot on. That was the problem. It's the second time I forget sort is constrained by default.