Problems with mimeCast TA for Splunk

[JRamirezEnosys]

Hello Splunkers,

We've been using the Splunk_TA_mimecast_for_splunk_v2 version 2.0.1 (https://apps.splunk.com/apps/id/Splunk_TA_mimecast_for_splunk_v2) for almost a year, but on Thursday 13th of December it stopped ingesting, and the sourcetype was removed from the list of Source Types in Splunk (Settings > Data > Source types).

We have then installed and configure TA-mimecast-for-splunk version 3.0.5 (https://apps.splunk.com/apps/id/TA-mimecast-for-splunk) but we are not ingesting it either.

Also, we audited the Server where Splunk is installed but we cannot see any strange activity.

Is anyone going through something similar or can I obtain some advise on how to solve this issue?

We have follow this KBA https://community.mimecast.com/docs/DOC-2142/

[simonsigre]

JRamirezEnosys; I would seriously consider upgrading all components to 3.1.1 .. all versions prior to that are horribly flawed.
There are a few issues in 3.1.1 also but its worlds apart.
You will need to recreate your inputs also.