Unless you know something I don't, Splunk is neither realtime nor API focused. Re-running the same query every second does not equate with "realtime". From a Splunk Employee, this more closely matches my experience with Splunk's API: https://community.splunk.com/t5/Splunk-Search/How-can-I-run-...