# Trying to integrate webhook functionality with splunk **URL:** \ **Category:** API and Webhooks\ **Created:** [August 14, 2020, 2:26pm UTC](https://devforum.zoom.us/t/trying-to-integrate-webhook-functionality-with-splunk/27172 "2020-08-14T14:26:09Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![lauren.olphert](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/lauren.olphert/32/13525_2.png) [@lauren.olphert](https://devforum.zoom.us/u/lauren.olphert)\ **Post date:** [August 14, 2020, 2:26pm UTC](https://devforum.zoom.us/t/trying-to-integrate-webhook-functionality-with-splunk/27172/1 "2020-08-14T14:26:09Z")
I am trying to integrate zoom with splunk using JWT authentication with a web hook attached to this. When I am trying to test the zoom connection, the splunk side is not receiving any information and zoom is receiving 500 or 404 error codes. We need to find out paths for the splunk side to enter for zoom: [zoom\_input://] - Configure an input for retrieving information from zoom - secret = - The secret key to decode the JWT encoded payload port = - The port to run the input on q! - path = - A wildcard that must match the path of the jwtwebhooks request i\* Example: /my\_jwtwebhook/\* cert\_file = - A path to an SSL certificate file. Including this will cause the app to use SSL/TLS. - The file typically uses the file extension of either .DER, .PEM, .CRT, or .CER - The path will be interpreted relative to the SPLUNK\_HOME path if it is relative - Example: etc/auth/splunkweb/cert.pem key\_file = - A wildcard that must match the path of the jwtwebhooks request - The file typically uses the file extension of .KEY - The path will be interpreted relative to the SPLUNK\_HOME path if it is relative - Example: etc/auth/splunkweb/privkey.pem - password = - A password to decrypt the private key if encrypted - Leave it empty if the private key is not encrypted ---
**Author:** ![ojus.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/ojus.zoom/32/734_2.png) [@ojus.zoom](https://devforum.zoom.us/u/ojus.zoom)\ **Post date:** [August 14, 2020, 10:14pm UTC](https://devforum.zoom.us/t/trying-to-integrate-webhook-functionality-with-splunk/27172/2 "2020-08-14T22:14:32Z")
@lauren.olphert can you share us a sample API request? If it contains confidential information, can you send it to [developersupport@zoom.us](mailto:developersupport@zoom.us)? Thanks ---
**Author:** ![esharew](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/esharew/32/13651_2.png) [@esharew](https://devforum.zoom.us/u/esharew)\ **Post date:** [August 17, 2020, 5:09pm UTC](https://devforum.zoom.us/t/trying-to-integrate-webhook-functionality-with-splunk/27172/3 "2020-08-17T17:09:13Z")
Hey @ojus.zoom – having the same issue as Lauren. Can you share any insight? ---
**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\ **Post date:** [August 19, 2020, 5:37pm UTC](https://devforum.zoom.us/t/trying-to-integrate-webhook-functionality-with-splunk/27172/4 "2020-08-19T17:37:59Z")
Hey @esharew, Can you please provide steps to reproduce the issue and which error messages you are seeing? 🙂 Thanks, Tommy ---
**Author:** ![lauren.olphert](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/lauren.olphert/32/13525_2.png) [@lauren.olphert](https://devforum.zoom.us/u/lauren.olphert)\ **Post date:** [September 3, 2020, 8:54am UTC](https://devforum.zoom.us/t/trying-to-integrate-webhook-functionality-with-splunk/27172/5 "2020-09-03T08:54:09Z")
Hi @ojus.zoom so we seem to have got round this, but we have a new problem… We currently have splunk logs set up and returning data from the webhooks in zoom, however on the webhook ‘user updated’ the logs are not returning the user email (this works with user deactivation/activation), it returns the user ID but not email. Is this an easy fix or something thats already been worked on? I can send a screenshot of the information if that helps ! ---
**Author:** ![will.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/will.zoom/32/14417_2.png) [@will.zoom](https://devforum.zoom.us/u/will.zoom)\ **Post date:** [September 8, 2020, 4:30pm UTC](https://devforum.zoom.us/t/trying-to-integrate-webhook-functionality-with-splunk/27172/6 "2020-09-08T16:30:11Z")
Hi @lauren.olphert, Would you mind sending that screenshot of the webhook payload, just to make sure we’re on the same page? If it contains confidential information, you can send this to [developersupport@zoom.us](mailto:developersupport@zoom.us) and reference this thread. Thanks! Will ---
**Author:** ![lauren.olphert](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/lauren.olphert/32/13525_2.png) [@lauren.olphert](https://devforum.zoom.us/u/lauren.olphert)\ **Post date:** [September 8, 2020, 5:12pm UTC](https://devforum.zoom.us/t/trying-to-integrate-webhook-functionality-with-splunk/27172/7 "2020-09-08T17:12:48Z")
Hey @will.zoom, I’ve sent a screenshot of the splunk log to that email address. The issue is that there is a user id (which can be used to track down the user) but not the user email being returned in the user.updated section. ---
**Author:** ![will.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/will.zoom/32/14417_2.png) [@will.zoom](https://devforum.zoom.us/u/will.zoom)\ **Post date:** [September 10, 2020, 5:02pm UTC](https://devforum.zoom.us/t/trying-to-integrate-webhook-functionality-with-splunk/27172/8 "2020-09-10T17:02:22Z")
Thanks @lauren.olphert! I’ve continued the conversation there. Thanks, Will ---
**Author:** ![andy.bean](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/andy.bean/32/16127_2.png) [@andy.bean](https://devforum.zoom.us/u/andy.bean)\ **Post date:** [September 29, 2020, 5:32pm UTC](https://devforum.zoom.us/t/trying-to-integrate-webhook-functionality-with-splunk/27172/10 "2020-09-29T17:32:51Z")
Has anyone worked through any SSL certification issues while trying to export Zoom data into Splunk? The Splunk App for Zoom, with the Webhook Only App create - fails with 500 errors and \* warning: ignoring value of ssl.verifyhost - NSS error -5938 - Closing connection #0 - SSL connect error curl: (35) SSL connect error ---
**Author:** ![will.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/will.zoom/32/14417_2.png) [@will.zoom](https://devforum.zoom.us/u/will.zoom)\ **Post date:** [September 30, 2020, 9:30pm UTC](https://devforum.zoom.us/t/trying-to-integrate-webhook-functionality-with-splunk/27172/11 "2020-09-30T21:30:44Z")
Hey @andy.bean, While this sounds to be a Splunk-related cert intricacy, have you had any luck checking out this error on stackoverflow or other forums? While not exactly the same, perhaps you’ll find something like this helpful: > **[Splunk apps: How do you resolve certificate verification errors?](https://community.splunk.com/t5/Security/Splunk-apps-How-do-you-resolve-certificate-verification-errors/m-p/371499)** > > I've searched the similar questions and did not find a direct answer. I have a Splunk APP (Code42) that fails because of SLL verification issues. "file=RESTClient.py:error:319 message="message="\[SSL: CERTIFICATE\_VERIFY\_FAILED\] certificate verify... Thanks, Will ---
**Author:** ![andy.bean](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/andy.bean/32/16127_2.png) [@andy.bean](https://devforum.zoom.us/u/andy.bean)\ **Post date:** [October 1, 2020, 1:26pm UTC](https://devforum.zoom.us/t/trying-to-integrate-webhook-functionality-with-splunk/27172/12 "2020-10-01T13:26:04Z")
Thanks Will - we changed the Port number and made a step forward but have not faced - We tried jwt token option today, based on zoom guidelines [https://marketplace.zoom.us/docs/guides/auth/jwt](https://marketplace.zoom.us/docs/guides/auth/jwt) Request: curl --request GET --url ‘[https://api.zoom.us/v2/users?status=active&page\_size=30&page\_number=1](https://api.zoom.us/v2/users?status=active&page_size=30&page_number=1)’ --header ‘authorization: Bearer {eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJhdWQiOm51bGwsImlzcyI6IllLVTNJZ1lmUlBXZzF1dTNyaDNfNVEiLCJleHAiOjE2MDIwOTE4MjYsImlhdCI6MTYwMTQ4NzAyN30.vAUxwhu4stsopCMb76J3uQLV0CxYqN\_UDpxE-yTv-sg}’ --header ‘content-type: application/json’ With response: {“code”:124,“message”:“The Token’s Signature resulted invalid when verified using the Algorithm: HmacSHA256”} ---
**Author:** ![will.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/will.zoom/32/14417_2.png) [@will.zoom](https://devforum.zoom.us/u/will.zoom)\ **Post date:** [October 2, 2020, 2:53pm UTC](https://devforum.zoom.us/t/trying-to-integrate-webhook-functionality-with-splunk/27172/13 "2020-10-02T14:53:18Z")
Hey @andy.bean, Are you having this issue if you test the request in Postman by copying the JWT token directly from your app in the marketplace? It sounds like there’s an issue with how you’re generating the token. Can you let me know if this thread helps: > [@Error: The Token's Signature resulted invalid when verified using the Algorithm: HmacSHA256](https://devforum.zoom.us/t/error-the-tokens-signature-resulted-invalid-when-verified-using-the-algorithm-hmacsha256/12601): > > I’m trying to authenticate with the Zoom API using C# and a [JWT.io](http://JWT.io) library (System.IdentityModel.Tokens.Jwt). When I use the token generated in the App Marketplace under JWT \> App Credentials I can retrieve info from [https://api.zoom.us/v2/users](https://api.zoom.us/v2/users), so I know my request to the API is fine. The problem I’m having is with generating a valid token. I’ve verified multiple times that my API Key and API Secret are both correct and are being passed into the correct variables. Here is my C# code for gener… Thanks, Will ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/6/1/614bdd549b610bbaa46ff934617683a02bdaa03c.png) [@system](https://devforum.zoom.us/u/system)\ **Post date:** [November 2, 2020, 12:53am UTC](https://devforum.zoom.us/t/trying-to-integrate-webhook-functionality-with-splunk/27172/14 "2020-11-02T00:53:24Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.