All Apps and Add-ons

Ingest Zoom logs in Splunk Cloud without a Heavy Forwarder?


Is it possible to use Splunk Connect for Zoom in a managed Splunk Cloud environment without an on-prem Heavy Forwarder? As far as I'm aware, Zoom only supports webhook-based logging which isn't compatible with Splunk Cloud (for some reason). Using a Heavy Forwarder isn't an option but open to other workarounds if any exist.

Scenario is:
- Running a managed Splunk Cloud instance on version 7.2.9
- Running an Inputs Data Manager (IDM) instance on version 7.2.9
- No heavy forwarder

Labels (1)

Splunk Employee
Splunk Employee

Alternative is to use http event collector (HEC) raw endpoint directly along with allowQueryStringAuth setting. This will allow you to specify HEC token directly in the URL.

More info here

Note: On cloud you'll have to open a support ticket to set allowQueryStringAuth to true on your HEC endpoint

0 Karma


What route did you end up going?

0 Karma
Get Updates on the Splunk Community!

Splunk Lantern | Getting Started with Edge Processor, Machine Learning Toolkit ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...