Why can I not see all events from zoom?

[okumar1]

Hi All

I can not able to see events from zoom, however when i search in _internal index I can see count of events showing from soure=zoom_input.log.

Please help me, i have set up the integration as per given in splunk doc and my input port 9997 is listining too.

[SanjayReddy]

Hi @okumar1 

It seems you have confiured inputs.conf  with internal index name ,

ideally _internal need to contains only Splunk logs which are related to Splunk application.

can you check your inputs.conf on UF/where zoom logs are generating 

ideally it should present under $SPLUNK_HOME/etc/system/local

if you are not sure about the inputs.conf location run follwing command from $SPLUNK_HOME/bin

./splunk btool inputs list <mention sourcetypeof zoom> --debug

inptus.conf 

chck the index the name mentioned for zoom_input.log 

and update the correct index name other than _internal and restart the splunkd 

exmaple inputs.conf 

[monitor:///zoom_input.log]
sourcetype = access_common
Index=<update for correct index name>