The TABLE_COUNT event is used in SAP to count the number of records and storage size for the largest tables in an SAP system.
Potential Use Cases
This event could be used for the following scenarios:
Determine candidates for data archiving.
Understand if records for a large table were unexpectedly deleted.
The event will look like this in Splunk:
Navigate to this data by using the SE16 transaction code. Then enter the table name of interest in the Table Name field, and hit the Enter key on your keyboard.
Then use the number of entries button from the selection screen.
Then the information regarding the record count, which matches the data in Splunk will appear.