I have installed the Mimecast App in splunk but am not receiving data. My set up is:
I have a Splunk heavy forwarder and a primary Splunk indexer.
In Mimecast, I have generated the required API keys etc.
On the Splunk heavy forwarder, I have installed the Mimecast app, added data inputs (SIEM and Directory so far) with the index as mimecast.
On the Splunk primary indexer, I have installed the Mimecast app and I have created the index "mimecast".
My understanding is that the forwarder will send the data to the indexer which it does for other unrelated data sources.
So far, there is no data appearing in the app on the forwarder or the indexer.
Are there any suggestions as to what may be going wrong?
if you don't see any errors and data is not being indexed that means the initial process which is used to collect events from Mimecast is still running. This process will exit when there are no events returned from Mimecast API which will never happen if your mimecast keeps generating events. This is kind of bug in TA. I have been working with Mimecast on this since 60 days.