The SLG1 event is used in SAP to display application logs.
Potential Use Cases
This event could be used in the following scenarios:
Trend SLG1 error messages over time
Alert on specific error conditions
Display business document processing based on the data within the application
The Metric Filter needs to be defined to extract data for this event. Log into the managed system and execute the /n/bnwvs/main transaction code. Then go to Administrator → Metric filters → SLG1 filter.
Then fill out the configuration based on your needs, and save. Below is a summary of the fields and their associated function:
Object - This field represents the application log object name. If you would like to extract data from all objects, place a wildcard value in this field (not recommended based on potential data volume), or specify an object from the SLG1 transaction that you would like to extract.
Subobject - This field represents the application log object's subobject, and is associated with the object field. If you would like to extract data from all subobjects, place a wildcard value in this field, or specify a subobject from the SLG1 transaction that you would like to extract.
User - This field is the name of the user that caused the log event. If you would like to extract data from all users that caused the log event, place a wildcard value in this field, or specify a specific username from the SLG1 transaction.
Mode - This field corresponds to the Log Creation mode, which is how the log was created. The potential values are A = Any, D = Dialog, I = In batch mode, and B = Batch input. Leave this field blank if you want to extract all log creation modes, otherwise specify the desired value.
Typ - This field refers to the message type. The potential values are: A = Abend/Cancel, E = Error, W = Warning, I = Information, S = Success. Leave this field blank if you want to extract all message types, otherwise specify the desired value.
Message Class - This field refers to the message class. If you want to extract data from all message classes, place a wildcard value in the message class field, otherwise specify the desired value.
Message Number - This field refers to the message number. If you want to extract data from all message number, place a wildcard value in the message number field, otherwise specify the desired value.
External ID - This is an ID that can be assigned to a particular application program. If you want to extract all external IDs associated with the selection criteria, place a wildcard value in this field, otherwise enter the desired external ID value.
Sequence - This field is used to make a unique entry into the table if the key fields of Object, Subobject, User, Mode, Typ, Message Class, and Message Number are identical. This is a numeric field, so if there are identical entries based on the field value combination previously stated, enter a unique sequence number as seen above.
INCL/EXCL - This is an include/exclude flag. Otherwise, use an I to include the objects. If you want to exclude certain objects from being selected input an E
Timezone - This field is used if the SLG1 log is being written to a user timezone that is not the system timezone. This field is primarily used if the customer discovers data is not being collected. This field can be left empty if the system timezone is being used, otherwise specify the user timezone value.
Active - Select this box to enable the configuration. If you would like to disable the configuration uncheck the box.
Here is an example of what the SLG1 metric filter looks like when it is filled out:
Important Note: The Metric Filter needs to be configured to enable data extraction for this event.
The event will look like this in Splunk:
Navigate to this data by using the SLG1 t-code, and enter the desired selection criteria from the subsequent screen, and select the Execute button.
Click on a specific application log. The information displayed will match the data extracted and sent to Splunk by the PowerConnect application.
Unit of Measure
Application Log: Date of last change
Application Log: Time of last change
Application Log: User that changed the log
Application log: date
Application log: expiry date
Application Log: Operating mode (Batch,Batch Input,Dialog)
Application log: Program name
Application log: Sort criterion/grouping
Application log: processing status
Application Log: Transaction code
Application log: Standard text
Application log: time
Application log: user name
Application Log: Size of a Character in Bytes
Application Log: Client in which a log was created
Application Log: External ID
Application log: log number
Application Log: Log Handle
Application Log: Message class, message ID
Application Log: Message number in message class
Application log: Internal message serial number
Application Log: Message type (A,E,W,I,S)
Application Log: Message variable 1
Application Log: Message variable 2
Application Log: Message variable 3
Application Log: Message variable 4
Application Log: Object Name (Application Code)
Application log: Object text
Application log: Message problem class
Application Log: Log problem class
Application Log: Subobject
Application log: sub-object text
Application Log: Context: DDIC structure name
Application Log: Callback: Routine name
Application Log: Callback: Program name
Application Log: Callback: Type (Ext. Perform, FM, etc.)
The UTC OFFSSET in HHMMSS that the data was collected in
The UTC positive or negative OFFSET indicator. Positive (+) means add UTCDIFF to find the time zone of the data, negative (-) means subtract the UTCDIFF to find the time zone adjusted date time the data was collected in.
+ | -