I faced an question about data cannot update to search head real time. i created serveral local app folder on one windows client. and part of monitor logs updates to search head real time. part of monitor log data disappears in search head suddenly and after several hours it updates data again and can find all data before. And i checked the log updated real time but not updated to splunk real-time.