Data Description

The SM13_STATE event is used in SAP to determine if the update processes are active or inactive for an application server.

Potential Use Cases

This event could be used in the following scenarios:

  • Alert when the update status changes to inactive for an application server.

  • Correlate the data with other data sources such as work process utilization and update failures.

Splunk Event

The event will look like this in Splunk:

SAP Navigation

Log into the managed system and execute the SM13 transaction code. Then select the Administration button.

Click on the Server tab.

You will then see the data that is transmitted to Splunk, which is the update status of the application server.

Field Mapping

Field

Description

Unit of Measure

CONTEXT

Update context (Code-page, DB node, ..)

String

CURRENT_TIMESTAMP

The date time stamp when the information was collected

YYYYMMDDHHMMSS

EVENT_SUBTYPE

String

EVENT_TYPE

SM13_STATE

String

LANGUAGETEXT

List of languages on update server

String

MAX_V1_RQ

2 byte value

Number

MAX_V2_RQ

2 byte value

Number

RQ_V1_CNT

4 byte value

Number

RQ_V2_CNT

4 byte value

Number

SERVER

Short VB server name

String

STATE

1 byte value

Number

STATUSTEXT

Update status

String

TYPE

1 byte value

Number

TYPETEXT

Update type

String

UTCDIFF

The UTC OFFSSET in HHMMSS that the data was collected in

HHMMSS

UTCSIGN

The UTC positive or negative OFFSET indicator. Positive (+) means add UTCDIFF to find the time zone of the data, negative (-) means subtract the UTCDIFF to find the time zone adjusted date time the data was collected in.

+ | -