Splunk® Connect for Zoom

Install and Administer Splunk Connect for Zoom

Acrobat logo Download manual as PDF

Acrobat logo Download topic as PDF

Troubleshoot Splunk Connect for Zoom

Zoom data does not appear

If Zoom data is not appearing in your Splunk platform deployment, perform the following steps to troubleshoot the connection between your Splunk heavy forwarder, and your Zoom platform.

  1. Open a terminal and run the following command to check port 4443 and see if the modular input is listening: - sudo lsof -i -P -n | grep LISTEN
  2. In the terminal, run the following curlcommand to send test data and check it in the configured index:
    curl -k https://localhost:4443 -X POST -H "Content-Type: application/json" -d '
      "event": "meeting.created",
      "payload": {
    	"account_id": "o8KK_AAACq6BBEyA70CA",
    	"operator": "someemail@email.com",
    	"operator_id": "uLoRgfbbTayCX6r2Q_qQsQ",
    	"object": {
      	"uuid": "czLF6FFFoQOKgAB99DlDb9g==",
      	"id": 111111111,
      	"host_id": "uLoRgfbbTayCX6r2Q_qQsQ",
      	"topic": "My Meeting",
      	"type": 2,
      	"start_time": "2019-07-09T17:00:00Z",
      	"duration": 60,
      	"timezone": "America/Los_Angeles"
  3. Log into the Zoom marketplace.
  4. Check your zoom webhook call logs to verify that there are no issues on the Zoom side of your data ingestion process.
  5. Navigate to your Splunk Enterprise heavy forwarder, and disable the webhook input.
  6. Reenable your webhook input.
  7. Restart your Splunk heavy forwarder.
Last modified on 22 April, 2020
Upgrade Splunk Connect for Zoom
Release notes for Splunk Connect for Zoom

This documentation applies to the following versions of Splunk® Connect for Zoom: 1.0.1

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters