Data Description

The WE02 event is used in SAP to view the status of iDocs.

Potential Use Cases

This event could be used for the following scenarios:

  • View iDoc volume trends over time.

  • Identify problematic interfaces within the environment.

  • Alert on iDoc failures.

  • Correlate iDoc traffic with other interface components to identify root-cause.

Splunk Event

The event will look like this in Splunk:

SAP Navigation

Navigate to this data by using one of the two approaches below:

SE16

Execute the SE16 transaction code in the managed system, and input EDIDC in the table name, and hit the Enter key.

Then enter the desired user selection parameters and execute the transaction.

The data below will match the data that is extracted by Splunk.

WE02
Alternatively the data is visible in the WE02 transaction code. Execute the WE02 transaction code and enter the desired user selection parameters and select the Execute button.

The data displayed in the table will match the values in Splunk.

Field Mapping

The field mapping between the data from SAP and values in Splunk can be seen in the table below:

Field

Description

Unit of Measure

ARCKEY

EDI archive key

String

CIMTYP

Extension

String

CREDAT

Date iDoc was created

YYYYMMDD

CRETIM

Time iDoc was created

HHMMSS

CURRENT_TIMESTAMP

The date time stamp when the information was collected

YYYYMMDDHHMMSS

DIRECT

Direction for iDoc

1 (outbound) | 2 (inbound)

DIRECTTEXT

Direction text

String

DOCNUM

iDoc number

Number

DOCREL

SAP Release for the iDoc

Number

DOCTYP

IDoc Type

String

EVENT_SUBTYPE

String

EVENT_TYPE

WE02

String

EXPRSS

Overriding in inbound processing

String

IDENT

EDI identification

String

IDOCTP

Basic type

String

MANDT

Client

Number

MAXSEGNUM

Number of data records

Number

MESCOD

Logical Message Variant

String

MESFCT

Logical message function

String

MESTYP

Message Type

String

OUTMOD

Output Mode

Number

PARTNR

Partner

String

RCVLAD

Logical address of recipient

String

RCVPFC

Partner Function of Receiver

String

RCVPOR

Receiver port (SAP System, EDI subsystem)

String

RCVPRN

Partner Number of Receiver

String

RCVPRT

Partner Type of Receiver

String

RCVSAD

Recipient address (SADR)

String

RCVSCA

Communication type (SADR) of recipient

String

RCVSDF

SADR default flag for recipient address

String

RCVSLF

Sequential Number of Recipient Address (SADR)

String

RCVSMN

SADR client (recipient)

String

RCVSNA

SADR flag for international recipient address

String

REFGRP

Reference to message group

String

REFINT

Reference to interchange file

String

REFMES

Reference to message

String

SERIAL

Serialization field

YYYYMMDDHHMMSS

SNDLAD

Logical address of sender

String

SNDPFC

Partner Function of Sender

String

SNDPOR

Sender port (SAP System, EDI subsystem)

String

SNDPRN

Partner Number of Sender

String

SNDPRT

Partner type of sender

String

SNDSAD

Sender address (SADR)

String

SNDSCA

Communication type (SADR) of sender

String

SNDSDF

SADR default flag for sender address

String

SNDSLF

Sequential Number of the Sender Address (SADR)

String

SNDSMN

SADR client (sender)

String

SNDSNA

SADR flag for international sender address

String

STATUS

Status of the iDoc record

Number

STATXT

Status text

String

STD

EDI Standard

String

STDMES

EDI message type

String

STDVRS

Version of EDI standard

String

TEST

Test Flag

String

UPDDAT

Date the iDoc was last updated

YYYYMMDD

UPDTIM

Time the iDoc was last updated

HHMMSS

UTCDIFF

The UTC OFFSSET in HHMMSS that the data was collected in

HHMMSS

UTCSIGN

The UTC positive or negative OFFSET indicator. Positive (+) means add UTCDIFF to find the time zone of the data, negative (-) means subtract the UTCDIFF to find the time zone adjusted date time the data was collected in.

+ | -