Troubleshoot Splunk Connect for Zoom

Zoom data does not appear

If Zoom data is not appearing in your Splunk platform deployment, perform the following steps to troubleshoot the connection between your Splunk heavy forwarder, and your Zoom platform.

1. Open a terminal and run the following command to check port 4443 and see if the modular input is listening: - sudo lsof -i -P -n | grep LISTEN
2. In the terminal, run the following curlcommand to send test data and check it in the configured index:

   curl -k https://localhost:4443 -X POST -H "Content-Type: application/json" -d '
   {
     "event": "meeting.created",
     "payload": {
   	"account_id": "o8KK_AAACq6BBEyA70CA",
   	"operator": "someemail@email.com",
   	"operator_id": "uLoRgfbbTayCX6r2Q_qQsQ",
   	"object": {
     	"uuid": "czLF6FFFoQOKgAB99DlDb9g==",
     	"id": 111111111,
     	"host_id": "uLoRgfbbTayCX6r2Q_qQsQ",
     	"topic": "My Meeting",
     	"type": 2,
     	"start_time": "2019-07-09T17:00:00Z",
     	"duration": 60,
     	"timezone": "America/Los_Angeles"
   	}
     }
   }'
   

3. Log into the Zoom marketplace.
4. Check your zoom webhook call logs to verify that there are no issues on the Zoom side of your data ingestion process.
5. Navigate to your Splunk Enterprise heavy forwarder, and disable the webhook input.
6. Reenable your webhook input.
7. Restart your Splunk heavy forwarder.