Data Description

The SPAD_STATUS event is used in SAP for spool administration.

Potential Use Cases

This event could be used in the following scenarios:

  • Identify and alert on devices which are not reachable for completing spool functions.

  • Create a dashboard to display spool status by device.

  • Correlation with other events in the environment such as data from SP01 or SM37.

Splunk Event

The event will look like this in Splunk:

SAP Navigation

Log into the managed system and execute the SPAD transaction. Then click on the Display button next to Output Devices.

The information displayed will match the data that is extracted and sent to Splunk.

Field Mapping

Field

Description

Unit of Measure

CURRENT_TIMESTAMP

The date time stamp when the information was collected

YYYYMMDDHHMMSS

EVENT_SUBTYPE

String

EVENT_TYPE

SPAD_STATUS

String

NAME

Spool: Long device names

String

PACLASS

Spool: Device class according to server assignment

String

PADEST

Spool: short name for output device

String

PAMETHOD

Spool: Host spool system access method

String

PAMODEL

Spool: Model of an output device

String

PAMSSERVER

Server Name

String

PATYPE

Spool: Device type name

String

RCCODE

Natural Number

Number

RCTEXT

Text field of length 240

String

UTCDIFF

The UTC OFFSSET in HHMMSS that the data was collected in

HHMMSS

UTCSIGN

The UTC positive or negative OFFSET indicator. Positive (+) means add UTCDIFF to find the time zone of the data, negative (-) means subtract the UTCDIFF to find the time zone adjusted date time the data was collected in.

+ | -