The usage of sort is fine if the number of items is not too large. To sort a large number of items is time consuming, and there is a limit in Splunk. Because of the limit, the attempt to sort the items and then to select the first 10 items might end in a wrong result. In order to avoid this, I filter all items above/below a limit that is specific to the problem. For instance, 50 000 records are processed, more than 49 000 records are processed within 2 seconds, but there are a few records for which the processing takes more time. So I set the limit to 2 seconds. However, if there are just a few records, e.g., 10, then it might be the case that the list of Top 10 results is empty because all of them are below the limit of 2 seconds. ... View more

Thanks for the fast reply. The idea is to join a request with the result of this request. Something like: index=... "Processing started" | join type=left left=L right=R where L.id = R.id [search index=... "Processing finished with result"] | table _time L.id L.dataSource L.message R.message R.orderNumber | sort _time desc  Simplified data: id=1234 dataSource=system1 message="Processing started of request from user abc" id=1234 dataSource=system1 message="Processing finished with result: Success" orderNumber=56789   ... View more