Data Description
The SM13_STATE event is used in SAP to determine if the update processes are active or inactive for an application server.
Potential Use Cases
This event could be used in the following scenarios:
Alert when the update status changes to inactive for an application server.
Correlate the data with other data sources such as work process utilization and update failures.
Splunk Event
The event will look like this in Splunk:
SAP Navigation
Log into the managed system and execute the SM13 transaction code. Then select the Administration button.
Click on the Server tab.
You will then see the data that is transmitted to Splunk, which is the update status of the application server.
Field Mapping
Field | Description | Unit of Measure |
|---|---|---|
CONTEXT | Update context (Code-page, DB node, ..) | String |
CURRENT_TIMESTAMP | The date time stamp when the information was collected | YYYYMMDDHHMMSS |
EVENT_SUBTYPE | String | |
EVENT_TYPE | SM13_STATE | String |
LANGUAGETEXT | List of languages on update server | String |
MAX_V1_RQ | 2 byte value | Number |
MAX_V2_RQ | 2 byte value | Number |
RQ_V1_CNT | 4 byte value | Number |
RQ_V2_CNT | 4 byte value | Number |
SERVER | Short VB server name | String |
STATE | 1 byte value | Number |
STATUSTEXT | Update status | String |
TYPE | 1 byte value | Number |
TYPETEXT | Update type | String |
UTCDIFF | The UTC OFFSSET in HHMMSS that the data was collected in | HHMMSS |
UTCSIGN | The UTC positive or negative OFFSET indicator. Positive (+) means add UTCDIFF to find the time zone of the data, negative (-) means subtract the UTCDIFF to find the time zone adjusted date time the data was collected in. | + | - |