Sorry I don’t think I explained it well. When you sort by different attributes, I believe the same query executed at different times can result in different results being returned due to timing. This is expected, for example if you sort on the timestamp of the logs, those timestamps were created on the agent machine and are not guaranteed to be received by the server in the same order. So if you query for logs that are very new and sort them by timestamp you may see some results out of order. My question are there any attributes that the server guarantees this doesn’t happen for? I thought maybe it was
created
since that seems like a server timestamp. Or is there some counter field I missed? Thank you.