What is the difference between search and real-time search? Doesn't a search provide real-time data?

[Roopaul]

What is the difference between search and real-time search? Doesn't the search provide the real-time data?

[andrewb_splunk]

The definition of real-time search in the Splunk documentation Splexicon is also useful: http://docs.splunk.com/Splexicon:Realtimesearch.

[skoelpin · Accepted solution]

There is a difference.. If you select Real Time search for 15 minutes then it will bring in the past ~15 minutes of data but is relative and will bring in new events as the time changes. So if you were to set a search for 15 minutes (Not real time) then it will only bring search results for the last 15 minutes and will not bring in new events.