Firewall Indexing Latency

[hartfoml]

I have my firewall sending UDP to a syslog-ng folder and Splunk is watching the file in the folder

I can see a latency for the latency like this
| eval diff_sec=(_indextime - _time)| where diff_sec > 0

But when I do a real-time search on the logs the view I get is sometimes much grater than the indexing latency

As I run the realtime search I see this as the events found and the events looked at "4,557 of 10,017 events matched"

the difference continues to grow the longer I have the realtime window open.

Why can't I see all the events that have been indexed?

[martin_mueller]

Doing a real-time search, the number of events scanned will increase for as long as the search is running. The number of matched events will rise and fall according to how many events actually do match within the window of your real-time search.

[hartfoml]

Martin thanks for your help,

Scanned vs matched

[martin_mueller]

What difference is growing, indextime vs time or scanned vs matched events?