You can include in your searches splunk_server=local this will let you retrieve the information from the indexes without the need for the dispatch_rest_to_indexers since this capability is not added to the Cloud users due to security purposes. ... View more