real-time search question

[a212830]

Hi,

Do real-time searches read events before they enter the indexer?

[sdaniels · Accepted solution]

http://docs.splunk.com/Documentation/Splunk/latest/Search/Aboutrealtimesearches

With real-time searches and reports, you can search events before they are indexed and preview reports as the events stream in.

[bmacias84]

Be careful with using real-time searches as you are grabbing events from the stream. If you have queue blocking on the forwarders or indexers where events are delayed, realtime charts may give an incomplete view of whats happening.