Dispatch_rest_to_indexers

[Poojitha]

Hi All,

I have a question. What exactly 'Dispatch_rest_to_indexers' mean ?

I am getting warning when running rest command and I am on splunk cloud.
Restricting results of the "rest" operator to the local instance because you do not have the "dispatch_rest_to_indexers" capability.

I see many blogs talking about this message but I did not come across clear explanation on what does this parameter exactly mean ? Dispatch_rest_to_indexers . What does this exactly do ?

Please can anyone throw some light on this .

Thanks in Advance,
PNV

[ggfloresca]

if this is not available for us "sc_users" can the splunk engineer create a visualization into the CMC console? or any alternative ways grabbing the health of your application in the search head? please advise, Thank you.

[isoutamo]

Basically it's possible that they create a report which use |rest to indexer if they also set it run as owner. That way it can execute those rest queries and return correct responses.

[PickleRick]

No. CMC is pre-built and a far as I know there's no way to edit it from the user's level. Also, what would you want to "monitor" when you can't dispatch rest to indexers? If you want to just dig through the logs, you don't need CMC for that.

[PickleRick]

This capability does (almost) exactly what it says - lets you dispatch a REST call (via the | rest command) to the indexers (to configured search peers, to be precise - in some cases (typically a Monitoring Console) you might want to REST against a non-indexer peer). Without it you can only call |rest to your local instance.

As far as I remember, that capability is not available for users in Cloud.

[isoutamo]

It’s available on Splunk’s own cloud engineers not for any customers, not even for role sc_admin.