https://community.splunk.com/t5/Splunk-Search/real-time-search-question/m-p/35852#M7903 <P>Be careful with using real-time searches as you are grabbing events from the stream. If you have queue blocking on the forwarders or indexers where events are delayed, realtime charts may give an incomplete view of whats happening.</P> Thu, 15 Aug 2013 20:52:36 GMT bmacias84 2013-08-15T20:52:36Z https://community.splunk.com/t5/Splunk-Search/real-time-search-question/m-p/35850#M7901 <P>Hi,</P> <P>Do real-time searches read events before they enter the indexer? </P> Thu, 15 Aug 2013 14:30:21 GMT https://community.splunk.com/t5/Splunk-Search/real-time-search-question/m-p/35850#M7901 a212830 2013-08-15T14:30:21Z https://community.splunk.com/t5/Splunk-Search/real-time-search-question/m-p/35851#M7902 <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/Search/Aboutrealtimesearches">http://docs.splunk.com/Documentation/Splunk/latest/Search/Aboutrealtimesearches</A></P> <P>With real-time searches and reports, you can search events before they are indexed and preview reports as the events stream in. </P> Thu, 15 Aug 2013 18:38:24 GMT https://community.splunk.com/t5/Splunk-Search/real-time-search-question/m-p/35851#M7902 sdaniels 2013-08-15T18:38:24Z https://community.splunk.com/t5/Splunk-Search/real-time-search-question/m-p/35852#M7903 <P>Be careful with using real-time searches as you are grabbing events from the stream. If you have queue blocking on the forwarders or indexers where events are delayed, realtime charts may give an incomplete view of whats happening.</P> Thu, 15 Aug 2013 20:52:36 GMT https://community.splunk.com/t5/Splunk-Search/real-time-search-question/m-p/35852#M7903 bmacias84 2013-08-15T20:52:36Z