Data Description
The [insert Group Definition name] TABLE_COUNT event is used in SAP to [insert information regarding what the transaction/table is used for in the SAP landscape]count the number of records and storage size for the largest tables in an SAP system.
Potential Use Cases
This event could be used for the following scenarios:
[Insert list of potential use cases]
[Metric Filters]
[Insert instructions on how to access the metric filter in the PowerConnect administrative console, how to fill out the metric filters and what functionality the metric filters provide]
Determine candidates for data archiving.
Understand if records for a large table were unexpectedly deleted.
Splunk Event
The event will look like this in Splunk:[Insert screenshot of sample event in Splunk]
...
SAP Navigation
Navigate to this data by using the [insert t-code used to access data][Insert screenshots showing the data from Splunk from each event, and how to navigate once in the t-code to show screens relevant to what data is extracted]SE16 transaction code. Then enter the table name of interest in the Table Name field, and hit the Enter key on your keyboard.
...
Then use the number of entries button from the selection screen.
...
Then the information regarding the record count, which matches the data in Splunk will appear.
...
Field Mapping
The field mapping between the data from SAP and values in Splunk can be seen in the table below:
Field | Description | Unit of Measure |
|---|---|---|
CURRENT_TIMESTAMP | The date time stamp when the information was collected | YYYYMMDDHHMMSS |
DBSPACE | Storage size in database (kilobytes) | Number |
EVENT_SUBTYPE | String | |
EVENT_TYPE | TABLE_COUNT | String |
RECORDS | Number of records in the table | Number |
TABNAME | Table name | String |
UTCDIFF | The UTC OFFSSET in HHMMSS that the data was collected in | HHMMSS |
UTCSIGN | The UTC positive or negative OFFSET indicator. Positive (+) means add UTCDIFF to find the time zone of the data, negative (-) means subtract the UTCDIFF to find the time zone adjusted date time the data was collected in. | + | - |