Data Description

The ST22 transaction is used to list the ABAP runtime errors that have occurred in an ABAP system as well as the relevant short dumps.

Potential Use Cases

This event could be used for the following scenarios:

  • Alert on specific dump types

  • Visualize system health over time

  • Correlate with batch job cancellations

  • Correlate with change records from a release to determine root cause

Splunk Event

The event will look like this in Splunk:

SAP Navigation

List of Selected Runtime Errors

Navigate to this data by using the ST22 t-code, and enter the user selection parameters followed by the “Start” button. Alternatively either the “Today” or “Yesterday” buttons can be selected depending on the desired analysis timeframe.

Then the main ST22 screen will appear showing the short dumps:

Field Mapping

The field mapping between the data from SAP and values in Splunk can be seen in the table below:

Group Definition/EVENT_TYPE

EVENT_SUBTYPE (if applicable)

SAP Field Name

Splunk Field Name

ST22

N/A

CURRENT_TIMESTAMP

ST22

Name of ABAP Runtime Error

DUMPID

ST22

N/A

EVENT_SUBTYPE

ST22

N/A

EVENT_TYPE

ST22

ABAP Program Name

INCLUDENAME

ST22

Application Server

INSTANCE_NAME

ST22

Job ID

JOBCOUNT

ST22

Job Name

JOBNAME

ST22

Source code line of an ABAP/4 program

LINENUMBER

ST22

ABAP Program: Current Main Program

PROGRAMNAME

ST22

System Date

SYDATE

ST22

System Time

SYTIME

ST22

User Name

SYUSER

ST22

N/A

UTCDIFF

ST22

N/A

UTCSIGN