Content Comparison

BEFORE COMPLETING THIS STEP: For Splunk Cloud customers running PowerConnect Splunk app versions 7.0.0-7.23.0, please refer to Knowledge Base #173 to address a bug specific to Splunk Cloud that may prevent the Master Inventory Lookup (and potentially other KVstore-based lookups) from generating properly.

...

1. Open the dashboard “Wizard for New SAP SIDs and Instances Discovery” under PowerConnect > Wizard menu.

   1. Select the checkboxes buttons corresponding to the desired search names.

   2. Click on the “Run Searches” button.

      The following saved searches should only be run if the user wants to use their respective dashboards:

      1. The status of the search would get updated in the Status column of the table. The user can view the search results once the search has completed by clicking in the table cell.

   3. The step would be complete when all the searches specified in the table have completed execution successfully with the exception of “Cloud CPI Source - Lookup Gen - Run Once Only” search.

   4. 1. 
         

      1. “Cloud CPI Source - Lookup Gen - Run Once Only“ for the dashboard “SAP Cloud - CPI Message Monitoring”

      2. “Cloud API Source - Lookup Gen - Run Once Only” for the dashboard “SAP Cloud - API Management Monitoring”

      3. “Cloud Success Factor Source - Lookup Gen - Run Once Only” for the dashboard “Success Factor Monitoring Dashboard” dashboards respectively .
         

         Image RemovedImage RemovedImage AddedImage Added

2. On Splunk's menu bar, Click on Settings -> “Searches, reports, and alerts” and manually run all the saved searches with the suffix ” – Run Once Only”. In case of a large number of events, if saved search execution does not get completed, try to reduce the time range and populate the lookups.
   

   Image Removed

...

1. 
   

   Image Added

“sap-index” Macro Configuration (Before v8.3.1):

Certain users/roles may not search the designated PowerConnect Splunk index by default. In order for saved searches to function properly, the “sap-index” macro may need to be set to specify the index for the SAP data sent to Splunk from PowerConnect.

1. On Splunk's menu bar, Click on

...

1. Settings ->

...

Before ::

...

Since our index is sap. Removed the double quotes and changed to index=sap and then run Post configuration wizard setup again.

After :

...

1. “Advanced search” -> “Search Macros”.

   Image Added

   Image Added

2. Click on the “sap-index” macro and mention the index name in the Definition where data is incoming. Please see the sample below:
               (index="main" OR index="sample1" OR index="sample2")
   Note: For selecting all value of an entity, "*" (asterisk) can be used. Logical operators like "AND", "OR" should be capitalized when used in Definition.

3. Click on the Save Button.

Additional Information

Note: If you are using SAP Cloud or want to change app language to German or Japanese; kindly follow the optional Post Installation Configuration