Data Description

The NRIV event is used in SAP for number range intervals. Each business document is assigned a distinct identifying number. These identifying numbers are controlled as part of number ranges intervals. If these ranges are exhausted it means that no further business documents can be created.

Potential Use Cases

This event could be used for the following scenarios:

  • Viewing business document creation over time

  • Monitoring to determine if number ranges are nearing exhaustion

Splunk Event

The event will look like this in Splunk:

SAP Navigation

Navigate to this data by using the SE16 t-code, and type “NRIV” into the Table Name field.

Hit “Enter” on your keyboard, and then enter the user-defined parameters for what you are looking for in the selection criteria. Then hit the “Execute” button.

The data will then be displayed, which will match the values in Splunk.

Field Mapping

The field mapping between the data from SAP and values in Splunk can be seen in the table below:

Group Definition/EVENT_TYPE

EVENT_SUBTYPE (if applicable)

SAP Field Name

Splunk Field Name

NRIV

Client

 CLIENT

NRIV

N/A

 CURRENT_TIMESTAMP

NRIV

N/A

EVENT_SUBTYPE

NRIV

N/A

EVENT_TYPE

NRIV

Internal (' ') or external ('X') number range flag

EXTERNIND

NRIV

From number

FROMNUMBER

NRIV

Number range status

NRLEVEL

NRIV

Number range number

NRRANGENR

NRIV

Name of number range object

OBJECT

NRIV

Number range object subobject value

SUBOBJECT

NRIV

To number

TONUMBER

NRIV

To fiscal year

TOYEAR

NRIV

N/A

UTCDIFF

NRIV

N/A

UTCSIGN