Do real-time searches read events before they enter the indexer?
With real-time searches and reports, you can search events before they are indexed and preview reports as the events stream in.
View solution in original post
Be careful with using real-time searches as you are grabbing events from the stream. If you have queue blocking on the forwarders or indexers where events are delayed, realtime charts may give an incomplete view of whats happening.