...
Alert on specific dump types
Visualize system health over time
Correlate with batch job cancellations
Correlate with change records from a release to determine root cause
...
Splunk Event
The event will look like this in Splunk:
...
SAP Navigation
List of Selected Runtime Errors
Navigate to this data by using the ST22 t-code, and enter the user selection parameters followed by the “Start” button. Alternatively either the “Today” or “Yesterday” buttons can be selected depending on the desired analysis timeframe.
...
Then the main ST22 screen will appear showing the short dumps:
...
Field Mapping
The field mapping between the data from SAP and values in Splunk can be seen in the table below:
...
Group Definition/EVENT_TYPE
...
EVENT_SUBTYPE (if applicable)
...
SAP Field Name
...
Splunk Field Name
...
ST22
...
N/A
...
CURRENT_TIMESTAMP
...
ST22
...
Name of ABAP Runtime Error
...
DUMPID
...
ST22
...
N/A
...
EVENT_SUBTYPE
...
ST22
...
N/A
...
EVENT_TYPE
...
ST22
...
ABAP Program Name
...
INCLUDENAME
...
ST22
...
Application Server
...
INSTANCE_NAME
...
ST22
...
Job ID
...
JOBCOUNT
...
ST22
...
Job Name
...
JOBNAME
...
ST22
...
Source code line of an ABAP/4 program
...
LINENUMBER
...
ST22
...
ABAP Program: Current Main Program
...
PROGRAMNAME
...
ST22
...
System Date
...
SYDATE
...
ST22
...
System Time
...
SYTIME
...
ST22
...
User Name
...
SYUSER
...
ST22
...
N/A
...
UTCDIFF
...
ST22
...
N/A
...
UTCSIGN