SM13_STATE

Data Description

The SM13_STATE event is used in SAP to determine if the update processes are active or inactive for an application server.

This event could be used in the following scenarios:

Alert when the update status changes to inactive for an application server.
Correlate the data with other data sources such as work process utilization and update failures.

The event will look like this in Splunk:

Log into the managed system and execute the SM13 transaction code. Then select the Administration button.

Click on the Server tab.

You will then see the data that is transmitted to Splunk, which is the update status of the application server.

Field	Description	Unit of Measure
CONTEXT	Update context (Code-page, DB node, ..)	String
CURRENT_TIMESTAMP	The date time stamp when the information was collected	YYYYMMDDHHMMSS
EVENT_SUBTYPE		String
EVENT_TYPE	SM13_STATE	String
LANGUAGETEXT	List of languages on update server	String
MAX_V1_RQ	2 byte value	Number
MAX_V2_RQ	2 byte value	Number
RQ_V1_CNT	4 byte value	Number
RQ_V2_CNT	4 byte value	Number
SERVER	Short VB server name	String
STATE	1 byte value	Number
STATUSTEXT	Update status	String
TYPE	1 byte value	Number
TYPETEXT	Update type	String
UTCDIFF	The UTC OFFSSET in HHMMSS that the data was collected in	HHMMSS
UTCSIGN	The UTC positive or negative OFFSET indicator. Positive (+) means add UTCDIFF to find the time zone of the data, negative (-) means subtract the UTCDIFF to find the time zone adjusted date time the data was collected in.	+ \| -