Is it necessary to include an ORDER BY $rising_column$ in my database tail query? This can be very expensive on a large database not indexed on that column. (example: using the row's modified_time rather than indexed column create_time)
Or is Splunk/DBX smart enough to get a result set back and find the maximum of that column for saving until next run.