Data Description
The SP01_CONTENT event is used to enable viewing and analyzing of spool request contents.
Potential Use Cases
This event could be used in the following scenarios:
Monitor content of spool requests
Analyzing and searching spool requests in Splunk based on the content string
Metric Configuration
The SP01_CONTENT metric has a configuration based on which the reading of spool requests content is controlled. To maintain the configuration, follow the below steps:
Maintain the SP01_CONTENT metric configuration using the menu option below (Administrator->Setup Metric->Metric Configuration)
The metric configuration has two parameters:
PAGELIMIT_TO_IGNORE: This parameter controls the spools requests for which spool contents need to be considered/ignored. If this parameter is maintained, it ignores the spool requests having pages more than the parameter value. By default this setting is 20 which means any spool requests containing more than 20 pages will be ignored.
READ_MAXPAGES: This parameter controls the number of pages needs to be read for spools requests. By default this setting is 5 which means contents of up to 5 pages will be read for spool requests and rest of the pages contents will be ignored.
Splunk Event
The event looks like this in Splunk:
SAP Navigation
Log in to the SAP system and execute the transaction SP01 and navigate to spool content of spool request/s.
Field Mapping
Field | Description | Unit of Measure |
---|---|---|
EVENT_TYPE | SP01_CONTENT | String |
EVENT_SUBTYPE | Not Applicable for this Event Type (always blank) | String |
CURRENT_TIMESTAMP | The date time stamp when the information was collected | YYYYMMDDHHMMSS |
RQIDENT | Spool Request Number | Numerical String |
TABIX | Line number of spool request | Numerical String |
LINE | Content of spool request line | String |
UTCDIFF | The UTC OFFSSET in HHMMSS that the data was collected in | HHMMSS |
UTCSIGN | The UTC positive or negative OFFSET indicator. Positive (+) means add UTCDIFF to find the time zone of the data, negative (-) means subtract the UTCDIFF to find the time zone adjusted date time the data was collected in. | + | - |