Can you monitor a keyword on logs in real time or do I have to manually start it?

[jbosano]

My question is about monitoring a keyword on logs.

Is the monitoring started when I search a keyword, or is it monitoring automatically?

For example: there is a log event at 6:00pm on a computer. At 7:00pm this computer is off. When I look for log event at 7:00, will I know about this event log?

[xpac]

Hey,

When you setup a file monitor, data is ingested ASAP, which means real time, maybe a few seconds delay.
If you search for it or not doesn't matter at all.

[jbosano]

Thank you very much for your answer