A real-time streaming service predicts an incoming flash crowd event and manages computing resources to respond to the event before traffic peaks, thus reducing the likelihood that the streaming service's resources will be overwhelmed. Embodiments of a real-time streaming server predict a flash crowd event by detecting actions by client devices during a multi-step process to access a real-time content stream from an endpoint server cluster. Initially, the endpoint server has first computing resources configured to stream the content stream to the client devices. The streaming server provisions second computing resources at the endpoint server based on a rate at which the client devices perform an action associated with a first step in the multi-step process. The second computing resources are configured to stream the real-time content stream based on a rate at which the client devices perform an action associated with a second step in the multi-step process.