Data Description

The TABLE_COUNT event is used in SAP to count the number of records and storage size for the largest tables in an SAP system.

Potential Use Cases

This event could be used for the following scenarios:

  • Determine candidates for data archiving.

  • Understand if records for a large table were unexpectedly deleted.

Splunk Event

The event will look like this in Splunk:

SAP Navigation

Navigate to this data by using the SE16 transaction code. Then enter the table name of interest in the Table Name field, and hit the Enter key on your keyboard.

Then use the number of entries button from the selection screen.

Then the information regarding the record count, which matches the data in Splunk will appear.

Field Mapping

The field mapping between the data from SAP and values in Splunk can be seen in the table below:

Field

Description

Unit of Measure

CURRENT_TIMESTAMP

The date time stamp when the information was collected

YYYYMMDDHHMMSS

DBSPACE

Storage size in database (kilobytes)

Number

EVENT_SUBTYPE

String

EVENT_TYPE

TABLE_COUNT

String

RECORDS

Number of records in the table

Number

TABNAME

Table name

String

UTCDIFF

The UTC OFFSSET in HHMMSS that the data was collected in

HHMMSS

UTCSIGN

The UTC positive or negative OFFSET indicator. Positive (+) means add UTCDIFF to find the time zone of the data, negative (-) means subtract the UTCDIFF to find the time zone adjusted date time the data was collected in.

+ | -