The SPAD_STATUS event is used in SAP for spool administration.
Potential Use Cases
This event could be used in the following scenarios:
Identify and alert on devices which are not reachable for completing spool functions.
Create a dashboard to display spool status by device.
Correlation with other events in the environment such as data from SP01 or SM37.
The event will look like this in Splunk:
Log into the managed system and execute the SPAD transaction. Then click on the Display button next to Output Devices.
The information displayed will match the data that is extracted and sent to Splunk.