Mimecast App with heavy forwarder

[balcv]

I have installed the Mimecast App in splunk but am not receiving data. My set up is:

I have a Splunk heavy forwarder and a primary Splunk indexer.
In Mimecast, I have generated the required API keys etc.
On the Splunk heavy forwarder, I have installed the Mimecast app, added data inputs (SIEM and Directory so far) with the index as mimecast.
On the Splunk primary indexer, I have installed the Mimecast app and I have created the index "mimecast".

My understanding is that the forwarder will send the data to the indexer which it does for other unrelated data sources.
So far, there is no data appearing in the app on the forwarder or the indexer.

Are there any suggestions as to what may be going wrong?

[balcv · Accepted solution]

Thanks for the log info as it told me what the problem was. It turns out I had not put https:// at the start of the Base URL. Once I added that, things started working.

Thanks

[thambisetty]

Firstly check for errors if there are any related to access using below search:

index=internal source=*ta_mimecast_for_splunk_mimecast*.log

if you don't see any errors and data is not being indexed that means the initial process which is used to collect events from Mimecast is still running. This process will exit when there are no events returned from Mimecast API which will never happen if your mimecast keeps generating events. This is kind of bug in TA. I have been working with Mimecast on this since 60 days.