Data Description

The SM51_STATE event is used in SAP to determine the application server status.

Potential Use Cases

This event could be used for the following scenarios:

  • To determine if all application servers have restarted after maintenance.

  • To alert on instances where an application server goes down.

Splunk Event

The event will look like this in Splunk:

SAP Navigation

Navigate to this data by using the SM51 t-code. The data from the opening screen shows the information from the SM51_STATE event.

Field Mapping

The field mapping between the data from SAP and values in Splunk can be seen in the table below:

Group Definition/EVENT_TYPE

EVENT_SUBTYPE (if applicable)

SAP Field Name

Splunk Field Name

SM51_STATE

N/A

CURRENT_TIMESTAMP

SM51_STATE

N/A

EVENT_SUBTYPE

SM51_STATE

N/A

EVENT_TYPE

SM51_STATE

Name of the Host Server

HOST

SM51_STATE

IPv4 Address

HOSTADDR_V4_STR

SM51_STATE

IP Address

HOSTADDR_V6_STR

SM51_STATE

Host IP address

HOSTADR

SM51_STATE

Host Name

HOSTNAMELONG

SM51_STATE

Services of the Application Server Instance

MSGTYPES

SM51_STATE

Application Server Instance

NAME

SM51_STATE

Service

SERV

SM51_STATE

Services

SERVICES

SM51_STATE

Service port number

SERVNO

SM51_STATE

Port

SERVNO_I

SM51_STATE

Server Status

STATE

SM51_STATE

Status

STATUS

SM51_STATE

System Services Registered on Message Server

SYSSERVICE0

SM51_STATE

System Services Registered on Message Server

SYSSERVICE1

SM51_STATE

System Services Registered on Message Server

SYSSERVICE2

SM51_STATE

System Services Registered on Message Server

SYSSERVICE3

SM51_STATE

N/A

UTCDIFF

SM51_STATE

N/A

UTCSIGN