All Apps and Add-ons

Problems with mimeCast TA for Splunk

JRamirezEnosys
Explorer

Hello Splunkers,

We've been using the Splunk_TA_mimecast_for_splunk_v2 version 2.0.1 (https://apps.splunk.com/apps/id/Splunk_TA_mimecast_for_splunk_v2) for almost a year, but on Thursday 13th of December it stopped ingesting, and the sourcetype was removed from the list of Source Types in Splunk (Settings > Data > Source types).

We have then installed and configure TA-mimecast-for-splunk version 3.0.5 (https://apps.splunk.com/apps/id/TA-mimecast-for-splunk) but we are not ingesting it either.

Also, we audited the Server where Splunk is installed but we cannot see any strange activity.

Is anyone going through something similar or can I obtain some advise on how to solve this issue?

We have follow this KBA https://community.mimecast.com/docs/DOC-2142/

0 Karma

simonsigre
Path Finder

JRamirezEnosys; I would seriously consider upgrading all components to 3.1.1 .. all versions prior to that are horribly flawed.
There are a few issues in 3.1.1 also but its worlds apart.
You will need to recreate your inputs also.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...