From bf62bb65609a4f5ed43d298eae9b2ef3341b26a9 Mon Sep 17 00:00:00 2001 From: mbonsack Date: Mon, 17 Aug 2020 08:58:01 -0700 Subject: [PATCH] `readthedocs` markdown workaround (#641) * `readthedocs` markdown workaround --- docs/gettingstarted/index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/gettingstarted/index.md b/docs/gettingstarted/index.md index e9dc8ec..02ab0d0 100644 --- a/docs/gettingstarted/index.md +++ b/docs/gettingstarted/index.md @@ -73,7 +73,7 @@ an intermediate tier of HWFs. - Create a HEC token that will be used by SC4S and ensure the token has access to place events in main, em_metrics, and all indexes used as event destinations. - * NOTE: It is recommended that the "Selected Indexes" on the token configuration page be left blank so that the token has access to +* NOTE: It is recommended that the "Selected Indexes" on the token configuration page be left blank so that the token has access to _all_ indexes, including the `lastChanceIndex`. If this list is populated, extreme care must be taken to keep it up to date, as an attempt to send data to an index not in this list will result in a `400` error from the HEC endpoint. Furthermore, the `lastChanceIndex` will _not_ be consulted in the event the index specified in the event is not configured on Splunk. Keep in mind just _one_ bad message will "taint" the