Data Description

The SM37 event is used in SAP to monitor batch jobs executed in the background.

Potential Use Cases

This event could be used for the following scenarios:

  • Visualize and trend historical batch job runtime

  • Monitor cancelled batch jobs

  • Alert on long-running batch jobs

  • Parse errors from job logs

  • Parse data from batch job spool files

  • Correlate batch jobs to work process logs

  • Correlate batch jobs to ABAP dumps

  • Identify delayed batch job execution

Metric Filters

To activate the collection of the spool files and job logs for a particular batch job please complete the following steps log into the managed system, and execute the /n/bnwvs/main transaction.

Then go to Administrator → Metric filters → SM37 job filter

Once in the SM37 job filter, select the “New Entries” button. Then place the string value for the batch job name that you would like to collect the data for. Please note that wildcards are accepted. Then select the checkboxes that meet your desired criteria:

  • Finished(Log) - Extracts the job log from batch jobs with a Finished status

  • Cancelled(Log) - Extracts the job log from batch jobs with a Cancelled status

  • Finished(Spool) - Extracts the spool file from batch jobs with a Finished status

  • Cancelled(Spool) - Extracts the spool file from batch jobs with a Cancelled status

After completing the configuration, hit the “Save” button and exit out of the PowerConnect administration console. The data should start being collected based on the filter criteria.

Splunk Event

SM37 with EVENT_SUBTYPE=””

The event will look like this in Splunk:

SM37 with EVENT_SUBTYPE=”LOGS”

The event will look like this in Splunk:

SM37 with EVENT_SUBTYPE=”STEP”

The event will look like this in Splunk:

SM37 with EVENT_SUBTYPE=”SPOOL”

The event will look like this in Splunk:

SAP Navigation

Navigate to this data by using the SM37 t-code in the managed system.

Once you have entered the SM37 t-code, enter the selection criteria and select “Execute”.

The SM37 data will now appear:

The data from the SM37 transaction is divided into several EVENT_SUBTYPEs in Splunk. Below are screenshots indicating where the data originates from for each EVENT_SUBTYPE.

SM37 with EVENT_SUBTYPE=””

The data from this EVENT_SUBTYPE originates from the TBTCO table, and can be viewed in the following SM37 screens:

Job Overview

Display Job

Accessed by double clicking a job name from the “Job Overview” screen:

Job Details

Accessed by clicking the “Job details” button from the “Display Job” screen:

SM37 with EVENT_SUBTYPE=”LOGS”

The data from this EVENT_SUBTYPE originates from the TBTC5 table and the job logs associated with the batch job, and can be viewed in the following SM37 screens:

Job Overview

Job Log

Accessed by clicking the “Job log” button from the “Job Overview” screen.

SM37 with EVENT_SUBTYPE=”STEP”

The data from this EVENT_SUBTYPE originates from the TBTCP table, and can be viewed in the following SM37 screens:

Step List Overview

Access by using the “Step” button from the “Job Overview” screen

SM37 with EVENT_SUBTYPE=”SPOOL”

The data from this EVENT_SUBTYPE originates from the spool files associated with the batch job, and can be viewed in the following SM37 screens:

Output Controller: List of Spool Requests

Access by using the “Spool” button from the “Job Overview” screen or clicking the spool icon from the “Job Overview” screen

Graphical display of spool request in system

Access by using the “Spool” button from the “Job Overview” screen or clicking the spool icon from the “Job Overview” screen

Once in the “Output Controller List of Spool Requests” page click on the “Display contents” button

Then the spool file will be visible in the “Graphical display of spool request in system” screen

Field Mapping

The field mapping between the data from SAP and values in Splunk can be seen in the table below:

Group Definition/EVENT_TYPE

EVENT_SUBTYPE (if applicable)

SAP Field Name

Splunk Field Name

SM37

Authorization check

AUTHCKMAN

SM37

Background user

AUTHCKNAM

SM37

Target system of background job

BTCSYSTEM

SM37

Correction Filed

CALCORRECT

SM37

Factory Calendar

CALENDARID

SM37

Job status check

CHECKSTAT

SM37

Reference value from job creator to identify job

CONFIRMED

SM37

Reference or job creator description

CTX_TXT_CNFRM

SM37

Reference or job creator description

CTX_TXT_INTRC

SM37

Reference value from job creator to identify job

CTX_VAL_CNFRM

SM37

Reference value from job creator to identify job

CTX_VAL_INTRC

SM37

N/A

CURRENT_TIMESTAMP

SM37

Delete Job

DELANFREP

SM37

Emergency

EMERGMODE

SM37

End date

ENDDATE

SM37

End time

ENDTIME

SM37

Correction field - Job execution

EOMCORRECT

SM37

Background event parameters

EVENTCOUNT

SM37

Background processing event

EVENTID

SM37

Background event parameters

EVENTPARM

SM37

N/A

EVENT_SUBTYPE

SM37

N/A

EVENT_TYPE

SM37

Server name

EXECSERVER

SM37

Reference value from job creator to identify job

INTERCEPTED

SM37

Report

INTREPORT

SM37

Job class

JOBCLASS

SM37

Job number

JOBCOUNT

SM37

Job group

JOBGROUP

SM37

N/A

JOBLOG

SM37

N/A

JOBLOGDATA

SM37

Job name

JOBNAME

SM37

Last job change date

LASTCHDATE

SM37

User that performed last job change

LASTCHNAME

SM37

Last job change time

LASTCHTIME

SM37

Latest execution date

LASTSTRTDT

SM37

Latest execution time

LASTSTRTTM

SM37

New job ID

NEWFLAG

SM37

Reference type: assignment of job to component or creator

PARENT_COUNT

SM37

Reference type: assignment of job to component or creator

PARENT_NAME

SM37

N/A

PC_CATEGORY

SM37

N/A

PC_PRIORITY

SM37

Periodic job

PERIODIC

SM37

Behavior

PRDBEHAV

SM37

Periodic job (days)

PRDDAYS

SM37

Periodic job (hours)

PRDHOURS

SM37

Periodic job (minutes)

PRDMINS

SM37

Periodic job (months)

PRDMONTHS

SM37

Periodic job

PRDWEEKS

SM37

Number of previous jobs

PREDNUM

SM37

Job priority

PRIORITY

SM37

Server name

REAXSERVER

SM37

Describe flag

RECDESCRIB

SM37

Logical system

RECLOGSYS

SM37

Key

RECOBJKEY

SM37

Object type

RECOBJTYPE

SM37

Scheduled release date

RELDATE

SM37

Scheduled release time

RELTIME

SM37

User that released scheduled batch job

RELUNAME

SM37

Runtime

RUNTIME

SM37

Schedule date

SDLDATE

SM37

Scheduled Start date

SDLSTRTDT

SM37

Scheduled Start time

SDLSTRTTM

SM37

Schedule time

SDLTIME

SM37

Scheduled name

SDLUNAME

SM37

Status

STATUS

SM37

Step number

STEPCOUNT

SM37

Start date

STRTDATE

SM37

Start Time

STRTTIME

SM37

Successor job

SUCCNUM

SM37

Server Group Name

TGTSRVGRP

SM37

N/A

UTCDIFF

SM37

N/A

UTCSIGN

SM37

WP Number

WPNUMBER

SM37

PID

WPPROCID

SM37

STEP

Background User Name for Authorization Check

AUTHCKNAM

SM37

STEP

Control flag for external program (e.g. trace level)

CONNCNTL

SM37

STEP

N/A

CURRENT_TIMESTAMP

SM37

STEP

N/A

EVENT_SUBTYPE

SM37

STEP

N/A

EVENT_TYPE

SM37

STEP

Exit code of an external program

EXITCODE

SM37

STEP

Name of Logical Command

EXTCMD

SM37

STEP

Job ID

JOBCOUNT

SM37

STEP

Background job name

JOBNAME

SM37

STEP

Language Key

LANGUAGE

SM37

STEP

ID of batch job output list in the spool

LISTIDENT

SM37

STEP

OPSYSTEM

OPSYSTEM

SM37

STEP

From line number in an internal report.

PROGFROMLN

SM37

STEP

Program name within a step (e.g. report)

PROGNAME

SM37

STEP

To line number in an internal report.

PROGTOLN

SM37

STEP

Date of job/step scheduling

SDLDATE

SM37

STEP

Time of a scheduled job/step

SDLTIME

SM37

STEP

Initiator of job/step scheduling

SDLUNAME

SM37

STEP

Status of step in background processing

STATUS

SM37

STEP

Control flag for external program (e.g. trace level)

STDERRCNTL

SM37

STEP

Control flag for external program (e.g. trace level)

STDINCNTL

SM37

STEP

Control flag for external program (e.g. trace level)

STDOUTCNTL

SM37

STEP

Job step ID number.

STEPCOUNT

SM37

STEP

Control flag for external program (e.g. trace level)

TERMCNTL

SM37

STEP

Control flag for external program (e.g. trace level)

TRACECNTL

SM37

STEP

N/A

UTCDIFF

SM37

STEP

N/A

UTCSIGN

SM37

STEP

Name of variant within a step

VARIANT

SM37

STEP

Identification of step as ABAP, ext. command or program

XPGFLAG

SM37

STEP

Parameters of external program (string)

XPGPARAMS

SM37

STEP

ID of external program

XPGPID

SM37

STEP

Name of external program (possibly with access path)

XPGPROG

SM37

STEP

Logical Destination (Specified in Function Call)

XPGRFCDEST

SM37

STEP

Target System to Run Background Job

XPGTGTSYS

SM37

LOGS

N/A

CURRENT_TIMESTAMP

SM37

LOGS

Dynpro Number

DYNPRO

SM37

LOGS

Date of entry into job log

ENTERDATE

SM37

LOGS

Job log entry time

ENTERTIME

SM37

LOGS

N/A

EVENT_SUBTYPE

SM37

LOGS

N/A

EVENT_TYPE

SM37

LOGS

Job ID

JOBCOUNT

SM37

LOGS

Background job name

JOBNAME

SM37

LOGS

Message ID

MSGID

SM37

LOGS

Message number

MSGNO

SM37

LOGS

Message type

MSGTYPE

SM37

LOGS

Message Variable

MSGV1

SM37

LOGS

Message Variable

MSGV2

SM37

LOGS

Message Variable

MSGV3

SM37

LOGS

Message Variable

MSGV4

SM37

LOGS

Current GUI Status

PFKEY

SM37

LOGS

ABAP Program: Current Main Program

PROGRAM

SM37

LOGS

DB key of an ABAP RABAX message

RABAXKEY

SM37

LOGS

Actual length of DB key of an ABAP RABAX message

RABAXKEYLN

SM37

LOGS

Sequence number

SEQNUM

SM37

LOGS

Message Text

TEXT

SM37

LOGS

N/A

UTCDIFF

SM37

LOGS

N/A

UTCSIGN

SM37

SPOOL

N/A

CURRENT_TIMESTAMP

SM37

SPOOL

N/A

EVENT_SUBTYPE

SM37

SPOOL

N/A

EVENT_TYPE

SM37

SPOOL

Job ID

JOBCOUNT

SM37

SPOOL

Background job name

JOBNAME

SM37

SPOOL

Line

LINE

SM37

SPOOL

Sequence number

SEQNUM

SM37

SPOOL

Step number

Step number

SM37

SPOOL

N/A

UTCDIFF

SM37

SPOOL

N/A

UTCSIGN