I'm getting strange behavior with a sort, and wondered if anyone knows why. If I run: index=os source=/var/log/sla/sla.log | table SLATime, SLAState | sort - SLATime I get a result set sorted by time as I would expect. If I run: index=os source=/var/log/sla/sla.log | table SLATime, SLAState | search SLAState=DOWN I get all of my down results as I would expect. If I run: index=os source=/var/log/sla/sla.log | table SLATime, SLAState | sort - SLATime | search SLAState=DOWN I get no results. So, I exported the results from the sort (without the search) to a CSV, and sure enough there were no events with a DOWN state in them. My DOWN states do contain the SLAState, and it is the same as other states. Why would sort be causing SLAState to no longer have down results? ... View more