Why is sorting by time reducing the number of my search results?

[ulrich_track]

I made a search over two indexes (OR connected) and five sourcetypes (OR connected), limited the time to two days and received 26,300 events. Now I pipe this to a sort _time and suddenly only 10,000 of 26,300 events match?

What is wrong here? Since when does sorting filter results?

Example:

index="index-one" OR index="index-two" sourcetype="sourcetype-one" OR sourcetype="sourcetype-two" OR sourcetype="sourcetype-three" OR sourcetype="sourcetype-four" OR sourcetype="sourcetype-five" | sort _time

[tom_frotscher · Accepted solution]

Hi,

sort is limited to 10000 results. Use this:

| sort limit=0 _time

or just

| sort 0 _time

Greetings

Tom