Dispatch_rest_to_indexers

[Poojitha]

Hi All,

I have a question. What exactly 'Dispatch_rest_to_indexers' mean ?

I am getting warning when running rest command and I am on splunk cloud.
Restricting results of the "rest" operator to the local instance because you do not have the "dispatch_rest_to_indexers" capability.

I see many blogs talking about this message but I did not come across clear explanation on what does this parameter exactly mean ? Dispatch_rest_to_indexers . What does this exactly do ?

Please can anyone throw some light on this .

Thanks in Advance,
PNV

[PickleRick]

This capability does (almost) exactly what it says - lets you dispatch a REST call (via the | rest command) to the indexers (to configured search peers, to be precise - in some cases (typically a Monitoring Console) you might want to REST against a non-indexer peer). Without it you can only call |rest to your local instance.

As far as I remember, that capability is not available for users in Cloud.

[isoutamo]

It’s available on Splunk’s own cloud engineers not for any customers, not even for role sc_admin.