The SM13_STATE event is used in SAP to determine if the update processes are active or inactive for an application server.
Potential Use Cases
This event could be used in the following scenarios:
Alert when the update status changes to inactive for an application server.
Correlate the data with other data sources such as work process utilization and update failures.
The event will look like this in Splunk:
Log into the managed system and execute the SM13 transaction code. Then select the Administration button.
Click on the Server tab.
You will then see the data that is transmitted to Splunk, which is the update status of the application server.