SU01
Data Description
The SU01 event is used to give a visibility of users maintained in managed SAP system. The extractor supports extraction from multiple clients. Following information is collected: list of users with basic attributes (EVENT_SUBTYPE=””), user profiles (EVENT_SUBTYPE=”PROF”) and user roles (EVENT_SUBTYPE=”ROLE). Default interval is 24 hours.
Potential Use Cases
This event could be used in the following scenarios:
Identify potential anomalies in the environment
Dashboard users with certain attributes, profiles or roles.
Lookup user profiles and roles.
Metric Filters
Metric filters are an optional configuration option for the SU01 extractor.
Extract Data From Multiple Clients
If you would like the SU01 data to reflect data from multiple clients, please follow the steps below:
Log into the managed client where PowerConnect is installed
Execute the /n/bnwvs/main transaction.
Stop the PowerConnect batch jobs.
Go to Administrator --> Setup Metric --> Metric Configuration

In the row with SU01 in the Group Definition field and MULTICLIENT in the Parameter Key field, add an X to the Parameter Value field as seen below. Then Save.

Start the PowerConnect batch jobs in the administrative console.
Splunk Event
SU01 with EVENT_SUBTYPE=””
The event will look like this in Splunk:

SU01 with EVENT_SUBTYPE=”ROLE”
The event will look like this in Splunk:

SU01 with EVENT_SUBTYPE=”PROF”
The event will look like this in Splunk:

SAP Navigation
Log into the managed system and execute the SU01 transaction code.