This is the reason that most searches of this type run at least 5 minutes back in time, preferably an hour or more. There really is no way around it. You can examine your latency with a search like this:
|tstats max(_indextime) AS indextime WHERE index=_* OR index=* BY index sourcetype _time
| stats avg(eval(indextime - _time)) AS latency BY index sourcetype
| fieldformat latency = tostring(latency, "duration")
| sort 0 - latency
... View more