...
Alert on specific dump types
Visualize system health over time
Correlate with batch job cancellations
Correlate with change records from a release to determine root cause
...
Splunk Event
The event will look like this in Splunk:
...
SAP Navigation
List of Selected Runtime Errors
...
Then the main ST22 screen will appear showing the short dumps:
...
Field Mapping
The field mapping between the data from SAP and values in Splunk can be seen in the table below:
...
Group Definition/EVENT_TYPE
...
EVENT_SUBTYPE (if applicable)
...
SAP Field Name
...
Splunk Field Name
...
ST22
...
N/A
...
CURRENT_TIMESTAMP
...
ST22
...
Name of ABAP Runtime Error
...
DUMPID
...
ST22
...
N/A
...
EVENT_SUBTYPE
...
ST22
...
N/A
...
EVENT_TYPE
...
ST22
...
ABAP Program Name
...
INCLUDENAME
...
ST22
...
Application Server
...
INSTANCE_NAME
...
ST22
...
Job ID
...
JOBCOUNT
...
ST22
...
Job Name
...
JOBNAME
...
ST22
...
Source code line of an ABAP/4 program
...
LINENUMBER
...
ST22
...
ABAP Program: Current Main Program
...
PROGRAMNAME
...
ST22
...
System Date
...
SYDATE
...
ST22
...
System Time
...
SYTIME
...
ST22
...
User Name
...
SYUSER
...
ST22
...
N/A
...
UTCDIFF
...
ST22
...
N/A
...
UTCSIGN