TLDR;  seems that stats list(x) as well as table commands return the events in the order they were indexed. I may be flogging a dead horse here but I thought to add my two cents after investigating the same topic recently. It is still relevant and helps to be aware of this behavior.  For my use case, I generated sample data and indexed it to a single Splunk Enterprise 9.0.1 instance. (So index clustering is not the culprit ) I noticed that the values/rows returned in my stats list(x) and table commands are ordered the same but not correctly by time. But when you do a search that just return the events, they are ordered correctly by _time as usual.  I realized that the events returned from the commands are ordered the same as the events in the input file and therefore the order they were indexed in.  This is of course a moot point when the data source is chronological making this one quite sneaky. ... View more