All Apps and Add-ons

Mimecast App with heavy forwarder

balcv
Contributor

I have installed the Mimecast App in splunk but am not receiving data. My set up is:

I have a Splunk heavy forwarder and a primary Splunk indexer.
In Mimecast, I have generated the required API keys etc.
On the Splunk heavy forwarder, I have installed the Mimecast app, added data inputs (SIEM and Directory so far) with the index as mimecast.
On the Splunk primary indexer, I have installed the Mimecast app and I have created the index "mimecast".

My understanding is that the forwarder will send the data to the indexer which it does for other unrelated data sources.
So far, there is no data appearing in the app on the forwarder or the indexer.

Are there any suggestions as to what may be going wrong?

Tags (1)
0 Karma
1 Solution

balcv
Contributor

Thanks for the log info as it told me what the problem was. It turns out I had not put https:// at the start of the Base URL. Once I added that, things started working.

Thanks

View solution in original post

0 Karma

balcv
Contributor

Thanks for the log info as it told me what the problem was. It turns out I had not put https:// at the start of the Base URL. Once I added that, things started working.

Thanks

0 Karma

thambisetty
Super Champion

Firstly check for errors if there are any related to access using below search:

index=internal source=*ta_mimecast_for_splunk_mimecast*.log

if you don't see any errors and data is not being indexed that means the initial process which is used to collect events from Mimecast is still running. This process will exit when there are no events returned from Mimecast API which will never happen if your mimecast keeps generating events. This is kind of bug in TA. I have been working with Mimecast on this since 60 days.

————————————
If this helps, give a like below.
0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>