When you perform a realtime search (ex 5 minute window) it is using the log's timestamp. As I'm trying to troubleshoot an issue I'd like to know in a real time capacity what is actually coming in regardless of the timestamp on the logs. Haven't been able to figure that out.
From the timerange picker, select Real-time -> All time (real-time).
I believe the events list will still only show events that are current as of "now()" but you can click in the timeline to see future events in the list.
this is rather drastic, but you could change the input's timestamping properties (in props.conf) to use DATETIME_CONFIG = NONE , which means it will base the timestamp on the 'time of receipt' by Splunk.
