I have deployed ChargeBack on the Splunk Cloud and the sc_admin is not allowed to have the dispatch_rest_to_indexers capability.  My question is how can I replace the | REST calls on their searches to achieve the same results?   the main initial search is | rest /services/data/indexes splunk_server=* thanks, -CC ... View more