Data Description
The WE02 event is used in SAP to view the status of iDocs.
Potential Use Cases
This event could be used for the following scenarios:
View iDoc volume trends over time.
Identify problematic interfaces within the environment.
Alert on iDoc failures.
Correlate iDoc traffic with other interface components to identify root-cause.
Splunk Event
The event will look like this in Splunk:
SAP Navigation
Navigate to this data by using one of the two approaches below:
SE16
Execute the SE16 transaction code in the managed system, and input EDIDC in the table name, and hit the Enter key.
Then enter the desired user selection parameters and execute the transaction.
The data below will match the data that is extracted by Splunk.
WE02
Alternatively the data is visible in the WE02 transaction code. Execute the WE02 transaction code and enter the desired user selection parameters and select the Execute button.
The data displayed in the table will match the values in Splunk.
Field Mapping
The field mapping between the data from SAP and values in Splunk can be seen in the table below:
Field | Description | Unit of Measure |
---|---|---|
ARCKEY | EDI archive key | String |
CIMTYP | Extension | String |
CREDAT | Date iDoc was created | YYYYMMDD |
CRETIM | Time iDoc was created | HHMMSS |
CURRENT_TIMESTAMP | The date time stamp when the information was collected | YYYYMMDDHHMMSS |
DIRECT | Direction for iDoc | 1 (outbound) | 2 (inbound) |
DIRECTTEXT | Direction text | String |
DOCNUM | iDoc number | Number |
DOCREL | SAP Release for the iDoc | Number |
DOCTYP | IDoc Type | String |
EVENT_SUBTYPE | String | |
EVENT_TYPE | WE02 | String |
EXPRSS | Overriding in inbound processing | String |
IDENT | EDI identification | String |
IDOCTP | Basic type | String |
MANDT | Client | Number |
MAXSEGNUM | Number of data records | Number |
MESCOD | Logical Message Variant | String |
MESFCT | Logical message function | String |
MESTYP | Message Type | String |
OUTMOD | Output Mode | Number |
PARTNR | Partner | String |
RCVLAD | Logical address of recipient | String |
RCVPFC | Partner Function of Receiver | String |
RCVPOR | Receiver port (SAP System, EDI subsystem) | String |
RCVPRN | Partner Number of Receiver | String |
RCVPRT | Partner Type of Receiver | String |
RCVSAD | Recipient address (SADR) | String |
RCVSCA | Communication type (SADR) of recipient | String |
RCVSDF | SADR default flag for recipient address | String |
RCVSLF | Sequential Number of Recipient Address (SADR) | String |
RCVSMN | SADR client (recipient) | String |
RCVSNA | SADR flag for international recipient address | String |
REFGRP | Reference to message group | String |
REFINT | Reference to interchange file | String |
REFMES | Reference to message | String |
SERIAL | Serialization field | YYYYMMDDHHMMSS |
SNDLAD | Logical address of sender | String |
SNDPFC | Partner Function of Sender | String |
SNDPOR | Sender port (SAP System, EDI subsystem) | String |
SNDPRN | Partner Number of Sender | String |
SNDPRT | Partner type of sender | String |
SNDSAD | Sender address (SADR) | String |
SNDSCA | Communication type (SADR) of sender | String |
SNDSDF | SADR default flag for sender address | String |
SNDSLF | Sequential Number of the Sender Address (SADR) | String |
SNDSMN | SADR client (sender) | String |
SNDSNA | SADR flag for international sender address | String |
STATUS | Status of the iDoc record | Number |
STATXT | Status text | String |
STD | EDI Standard | String |
STDMES | EDI message type | String |
STDVRS | Version of EDI standard | String |
TEST | Test Flag | String |
UPDDAT | Date the iDoc was last updated | YYYYMMDD |
UPDTIM | Time the iDoc was last updated | HHMMSS |
UTCDIFF | The UTC OFFSSET in HHMMSS that the data was collected in | HHMMSS |
UTCSIGN | The UTC positive or negative OFFSET indicator. Positive (+) means add UTCDIFF to find the time zone of the data, negative (-) means subtract the UTCDIFF to find the time zone adjusted date time the data was collected in. | + | - |