Data Description

The SP01_CONTENT event is used to enable viewing and analyzing of spool request contents.

Potential Use Cases

This event could be used in the following scenarios:

  • Monitor content of spool requests

  • Analyzing and searching spool requests in Splunk based on the content string

Metric Configuration

The SP01_CONTENT metric has a configuration based on which the reading of spool requests content is controlled. To maintain the configuration, follow the below steps:

  • Maintain the SP01_CONTENT metric configuration using the menu option below (Administrator->Setup Metric->Metric Configuration)

  • The metric configuration has two parameters:

    • PAGELIMIT_TO_IGNORE: This parameter controls the spools requests for which spool contents need to be considered/ignored. If this parameter is maintained, it ignores the spool requests having pages more than the parameter value. By default this setting is 20 which means any spool requests containing more than 20 pages will be ignored.

    • READ_MAXPAGES: This parameter controls the number of pages needs to be read for spools requests. By default this setting is 5 which means contents of up to 5 pages will be read for spool requests and rest of the pages contents will be ignored.

Splunk Event

The event looks like this in Splunk:

SAP Navigation

Log in to the SAP system and execute the transaction SP01 and navigate to spool content of spool request/s.

Field Mapping

Field

Description

Unit of Measure

EVENT_TYPE

SP01_CONTENT

String

EVENT_SUBTYPE

Not Applicable for this Event Type (always blank)

String

CURRENT_TIMESTAMP

The date time stamp when the information was collected

YYYYMMDDHHMMSS

RQIDENT

Spool Request Number

Numerical String

TABIX

Line number of spool request

Numerical String

LINE

Content of spool request line

String

UTCDIFF

The UTC OFFSSET in HHMMSS that the data was collected in

HHMMSS

UTCSIGN

The UTC positive or negative OFFSET indicator. Positive (+) means add UTCDIFF to find the time zone of the data, negative (-) means subtract the UTCDIFF to find the time zone adjusted date time the data was collected in.

+ | -