http://docs.splunk.com/Documentation/Splunk/latest/Search/Aboutrealtimesearches
With real-time searches and reports, you can search events before they are indexed and preview reports as the events stream in.
http://docs.splunk.com/Documentation/Splunk/latest/Search/Aboutrealtimesearches
With real-time searches and reports, you can search events before they are indexed and preview reports as the events stream in.
Be careful with using real-time searches as you are grabbing events from the stream. If you have queue blocking on the forwarders or indexers where events are delayed, realtime charts may give an incomplete view of whats happening.