# Zoom integration with Splunk via HEC not working

**URL:** <https://devforum.zoom.us/t/zoom-integration-with-splunk-via-hec-not-working/133262>\
**Category:** API and Webhooks\
**Tags:** webhooks, api\
**Created:** [May 28, 2025, 12:17am UTC](https://devforum.zoom.us/t/zoom-integration-with-splunk-via-hec-not-working/133262 "2025-05-28T00:17:15Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Bhagyashri](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/bhagyashri/32/69375_2.png) [@Bhagyashri](https://devforum.zoom.us/u/Bhagyashri)\
**Post date:** [May 28, 2025, 12:17am UTC](https://devforum.zoom.us/t/zoom-integration-with-splunk-via-hec-not-working/133262/1 "2025-05-28T00:17:15Z")

</div>

Hi,

We are trying to integrate Zoom into Splunk through HEC on a local heavy forwarder. It did pass through the URL validation. I have added allowQueryStringAuth = true in input.conf. However, we are seeing -12 status code in the webhook app call logs. Please let us know how we can solve this issue.

Thanks

---

<div class="post-metadata">

**Author:** ![elisa.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/elisa.zoom/32/47836_2.png) [@elisa.zoom](https://devforum.zoom.us/u/elisa.zoom)\
**Post date:** [May 29, 2025, 3:34pm UTC](https://devforum.zoom.us/t/zoom-integration-with-splunk-via-hec-not-working/133262/2 "2025-05-29T15:34:29Z")

</div>

Hi @Bhagyashri  
Thanks for reaching out to us and welcome to the Zoom developer forum!  
Have you tried reaching out to Splunk? they should be able to troubleshoot that error

---

<div class="post-metadata">

**Author:** ![Bhagyashri](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/bhagyashri/32/69375_2.png) [@Bhagyashri](https://devforum.zoom.us/u/Bhagyashri)\
**Post date:** [May 29, 2025, 7:03pm UTC](https://devforum.zoom.us/t/zoom-integration-with-splunk-via-hec-not-working/133262/3 "2025-05-29T19:03:50Z")

</div>

Hi Elisa,

Yes have reached out to splunk about this and it was verified that we have valid hec token, have the necessary inputs.conf setting and have necessary allowlisting done for port 443. The status code -12 I am seeing is in zoom call logs. Does this require any kind of signed cert on splunk host?

Thanks  
Bhagyashri

---

<div class="post-metadata">

**Author:** ![elisa.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/elisa.zoom/32/47836_2.png) [@elisa.zoom](https://devforum.zoom.us/u/elisa.zoom)\
**Post date:** [May 29, 2025, 7:25pm UTC](https://devforum.zoom.us/t/zoom-integration-with-splunk-via-hec-not-working/133262/4 "2025-05-29T19:25:39Z")

</div>

I will send you a DM, please follow up there

---

<div class="post-metadata">

**Author:** ![Bhagyashri](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/bhagyashri/32/69375_2.png) [@Bhagyashri](https://devforum.zoom.us/u/Bhagyashri)\
**Post date:** [June 3, 2025, 3:12pm UTC](https://devforum.zoom.us/t/zoom-integration-with-splunk-via-hec-not-working/133262/5 "2025-06-03T15:12:10Z")

</div>

Hi @elisa.zoom I have not received DM from you yet. I can share the screenshot to understand the issue further.

---

<div class="post-metadata">

**Author:** ![elisa.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/elisa.zoom/32/47836_2.png) [@elisa.zoom](https://devforum.zoom.us/u/elisa.zoom)\
**Post date:** [June 6, 2025, 2:13pm UTC](https://devforum.zoom.us/t/zoom-integration-with-splunk-via-hec-not-working/133262/6 "2025-06-06T14:13:23Z")

</div>

Let me re send it 🙂 @Bhagyashri

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/6/1/614bdd549b610bbaa46ff934617683a02bdaa03c.png) [@system](https://devforum.zoom.us/u/system)\
**Post date:** [June 10, 2026, 5:49am UTC](https://devforum.zoom.us/t/zoom-integration-with-splunk-via-hec-not-working/133262/7 "2026-06-10T05:49:49Z")

</div>

Closed on June 10, 2026, 5:49am UTC

This topic was automatically closed 368 days after the last reply. New replies are no longer allowed.
