Hi All,
I have a question. What exactly 'Dispatch_rest_to_indexers' mean ?
I am getting warning when running rest command and I am on splunk cloud.
Restricting results of the "rest" operator to the local instance because you do not have the "dispatch_rest_to_indexers" capability.
I see many blogs talking about this message but I did not come across clear explanation on what does this parameter exactly mean ? Dispatch_rest_to_indexers . What does this exactly do ?
Please can anyone throw some light on this .
Thanks in Advance,
PNV
This capability does (almost) exactly what it says - lets you dispatch a REST call (via the | rest command) to the indexers (to configured search peers, to be precise - in some cases (typically a Monitoring Console) you might want to REST against a non-indexer peer). Without it you can only call |rest to your local instance.
As far as I remember, that capability is not available for users in Cloud.