CPEs send flows on a scheduled period. Let’s take 5 minutes as the export period: For five minutes, the CPEs aggregate traffic. Then, they export the aggregated flows, the next five minutes (smooth export to prevent spike of traffic in the collection link). eye.lo collects the data on the fly and starts data processing at the end of the five minutes export period. So when an event occurs, it will be displayed between 5:30 minutes (best case) to 14 minutes after the event (Worst case with heavy load on the eye.lo servers).