topic Dispatch_rest_to_indexers in Security

Dispatch_rest_to_indexers

Poojitha — Wed, 28 Feb 2024 09:57:23 GMT

Hi All,

I have a question. What exactly 'Dispatch_rest_to_indexers' mean ?

I am getting warning when running rest command and I am on splunk cloud.
Restricting results of the "rest" operator to the local instance because you do not have the "dispatch_rest_to_indexers" capability.

I see many blogs talking about this message but I did not come across clear explanation on what does this parameter exactly mean ? Dispatch_rest_to_indexers . What does this exactly do ?

Please can anyone throw some light on this .

Thanks in Advance,
PNV

Re: Dispatch_rest_to_indexers

PickleRick — Wed, 28 Feb 2024 11:08:30 GMT

This capability does (almost) exactly what it says - lets you dispatch a REST call (via the | rest command) to the indexers (to configured search peers, to be precise - in some cases (typically a Monitoring Console) you might want to REST against a non-indexer peer). Without it you can only call |rest to your local instance.

As far as I remember, that capability is not available for users in Cloud.

Re: Dispatch_rest_to_indexers

isoutamo — Fri, 01 Mar 2024 17:53:23 GMT

It’s available on Splunk’s own cloud engineers not for any customers, not even for role sc_admin.

Re: Dispatch_rest_to_indexers

ggfloresca — Sat, 09 Nov 2024 00:48:12 GMT

if this is not available for us "sc_users" can the splunk engineer create a visualization into the CMC console? or any alternative ways grabbing the health of your application in the search head? please advise, Thank you.

Re: Dispatch_rest_to_indexers

PickleRick — Sat, 09 Nov 2024 07:22:56 GMT

No. CMC is pre-built and a far as I know there's no way to edit it from the user's level. Also, what would you want to "monitor" when you can't dispatch rest to indexers? If you want to just dig through the logs, you don't need CMC for that.

Re: Dispatch_rest_to_indexers

isoutamo — Wed, 13 Nov 2024 23:39:29 GMT

Basically it's possible that they create a report which use |rest to indexer if they also set it run as owner. That way it can execute those rest queries and return correct responses.