ABAP Data Extraction User Guide
Summary
This user guide was prepared to ensure that customers understand what SAP data PowerConnect can send to Splunk, and how to optimize their environment’s configuration to maximize business value. Please review the corresponding menu options on the left for a detailed summary of each of the data types available for extraction.
View and Configure Data Extraction Events
Events collected by PowerConnect typically correspond to an SAP transaction code (t-code) or table, and are represented in the EVENT_TYPE field in Splunk. The PowerConnect events for extraction are defined in the Group Def section of the PowerConnect administration console.
The PowerConnect administration console can be accessed by using the /n/bnwvs/main t-code in the managed system.
After entering the PowerConnect administration console go to Administrator → Setup Group Def.
Important Note: It is recommended that you stop all PowerConnnect batch jobs prior to making configuration changes to the Group Def.
The Group Def page defines what data will be collected in SAP and sent to Splunk.
Here are the field definitions from this configuration screen:
Field Name | Definition | Field Type | Mandatory |
|---|---|---|---|
Group Definition | This field corresponds to the EVENT_TYPE visible in Splunk and typically the transaction code or table from SAP | Text | Yes |
Suspend Interval | This field determines the frequency at which data is extracted in the SAP environment (collection interval) | Numeric | Yes |
Delay | This delays the extraction by this number in seconds. Some SAP databases delay writes from the application to the database, due to transactional consistency, reading back using a delay ensures all data is written to the database and readable so buffered data is not lost. | Numeric | No |
Mod. Max Interval | Checkbox | No | |
Maximum Last Interval | This controls how far back (maximum) the agent will look back in the past for data if the agent is not running. If the agent is stopped for an extended period (days or weeks) then getting all data could have a high impact on system resources and impact performance, to prevent this the agent will look back maximum 15x the collection interval | Numeric | Yes |
Use schedule | This checkbox enables or disables the scheduling feature, which is another method to define the data extraction interval | Checkbox | No |
Schedule | Another method to specify the frequency at which data is extracted, this allows data to be collected on a schedule using a mechanism similar to the SM37 batch job scheduling system | Prompt | No |
Job | Status indicator to show whether the job that is created when the schedule mechanism is used, is scheduled correctly (and operating correctly) | Icon | No |
AS Instance | Allows the collection of this EVENT_TYPE to be forced to be collected on a specific SAP instance (this should not be configured unless there is a reason to do so, generally this should normally be left blank) | Text | No |
Splunk Index | Specifies the index in which this data should be saved to in the Splunk indexer. You can direct each EVENT_TYPE to a different index, but they must all be send to the same group of indexers, you can no direct an EVENT_TYPE to a specific indexer, only to a specific index | Text | No |
Active | This checkbox activates and deactivates the data extraction for the particular event | Checkbox | Yes |
Category | This is a metadata tag, which is used to categorize the event and it’s use i.e. Performance, Database, Security, ITSI | Text | No |
Enable/Disable Data Extraction
To enable data extraction for a particular event, ensure that the “Active” field is checked for the row corresponding to the Group Definition.
To disable data extraction for a particular event, ensure that the “Active” field is unchecked for the row corresponding to the Group Definition.
Important Note: It is recommended that you stop all PowerConnnect batch jobs prior to making configuration changes to the Group Def.
Modify Data Extraction Interval
To modify the data extraction interval for a particular event, change the value in the “Suspend Interval” field to correspond with the number of seconds at which you would like to extract data (e.g. 3600 would mean every hour).
Important Note: It is recommended that you stop all PowerConnnect batch jobs prior to making configuration changes to the Group Def.
