SM21_LOG (Draft)

Data Description

The SM21_LOG event is used in SAP to view the system log.

Potential Use Cases

This event could be used in the following scenarios:

• Alert on specific error messages displayed in the system log.

• Visualize system health status by application server.

• Determine error trends over time.

• Correlate system errors with other occurrences in the environment such as database failures.

Metric Filters

This filter is used to select or exclude specific messages from the system log and is an optional configuration to control data volume sent to Splunk. To access the filter, log into the managed system and execute the /n/bnwvs/main transaction code. Then go to Administrator → Metric Filters → More → SM21 Sys.Log Filter.

Then select the “New Entries” button and enter the desired configuration based on the configuration options defined below, and Save:

• SAP Instance -

• Clt -

• User -

• Grp -

• N -

• Message Text -

• INCL/EXCL - This field is mandatory and is an exclusion or inclusion criteria. To exclude the values defined in the selection criteria enter an “E“ in the field. Similarly, to include the values defined in the selection criteria enter an “I” in the field.

• Active - This field is mandatory and is a checkbox used to enable or disable the filter criteria. To activate the filter criteria, ensure the checkbox is checked. Conversely, if you would like to disable data collection ensure the checkbox is unchecked.

Splunk Event

The event will look like this in Splunk:

SAP Navigation

[insert information on how to see the information displayed in the Splunk event in the SAP environment. Typically this is a t-code or a table. Please insert instructions with screenshots.]

Field Mapping