...
Field Name | Definition | Field Type | Mandatory |
|---|---|---|---|
Group Definition | This field corresponds to the EVENT_TYPE visible in Splunk and typically the transaction code or table from SAP | Text | Yes |
Suspend Interval | This field determines the frequency at which data is extracted in the SAP environment (collection interval) | Numeric | Yes |
Delay | This delays the extraction by this number in seconds. Some SAP databases delay writes from the application to the database, due to transactional consistency, reading back using a delay ensures all data is written to the database and readable so buffered data is not lost. | Numeric | No |
Mod. Max Interval | Checkbox | No | |
Maximum Last Interval | This controls how far back (maximum) the agent will look back in the past for data if the agent is not running. If the agent is stopped for an extended period (days or weeks) then getting all data could have a high impact on system resources and impact performance, to prevent this the agent will look back maximum 15x the collection interval | Numeric | Yes |
Use schedule | This checkbox enables or disables the scheduling feature, which is another method to define the data extraction interval | Checkbox | No |
Schedule | Another method to specify the frequency at which data is extracted, this allows data to be collected on a schedule using a mechanism similar to the SM37 batch job scheduling system | Prompt | No |
Job | Status indicator to show whether the job that is created when the schedule mechanism is used, is scheduled correctly (and operating correctly) | Icon | No |
AS Instance | Allows the collection of this EVENT_TYPE to be forced to be collected on a specific SAP instance (this should not be configured unless there is a reason to do so, generally this should normally be left blank) | Text | No |
Splunk Index | Specifies the index in which this data should be saved to in the Splunk indexer. You can direct each EVENT_TYPE to a different index, but they must all be send to the same group of indexers, you can no direct an EVENT_TYPE to a specific indexer, only to a specific index | Text | No |
Active | This checkbox activates and deactivates the data extraction for the particular event | Checkbox | Yes |
Category | This is a metadata tag, which is used to categorize the event and it’s use i.e. Performance, Database, Security, ITSI | Text | No |
Enable/Disable Data Extraction
...