Document toolboxDocument toolbox

ABAP Data Extraction User Guide

Summary

This user guide was prepared to ensure that customers understand what SAP data PowerConnect can send to Splunk, and how to optimize their environment’s configuration to maximize business value. Please review the corresponding menu options on the left for a detailed summary of each of the data types available for extraction.

View and Configure Data Extraction Events

Events collected by PowerConnect typically correspond to an SAP transaction code (t-code) or table, and are represented in the EVENT_TYPE field in Splunk. The PowerConnect events for extraction are defined in the Group Def section of the PowerConnect administration console.

The PowerConnect administration console can be accessed by using the /n/bnwvs/main t-code in the managed system.

After entering the PowerConnect administration console go to Administrator → Setup Group Def.

Important Note: It is recommended that you stop all PowerConnnect batch jobs prior to making configuration changes to the Group Def.

The Group Def page defines what data will be collected in SAP and sent to Splunk.

Here are the field definitions from this configuration screen:

Field Name

Definition

Field Type

Mandatory

Field Name

Definition

Field Type

Mandatory

Group Definition

This field corresponds to the EVENT_TYPE visible in Splunk and typically the transaction code or table from SAP

Text

Yes

Suspend Interval

This field determines the frequency at which data is extracted in the SAP environment (collection interval)

Numeric

Yes

Delay

This delays the extraction by this number in seconds. Some SAP databases delay writes from the application to the database, due to transactional consistency, reading back using a delay ensures all data is written to the database and readable so buffered data is not lost.

Numeric

No

Mod. Max Interval

 

Checkbox

No

Maximum Last Interval

This controls how far back (maximum) the agent will look back in the past for data if the agent is not running. If the agent is stopped for an extended period (days or weeks) then getting all data could have a high impact on system resources and impact performance, to prevent this the agent will look back maximum 15x the collection interval

Numeric

Yes

Use schedule

This checkbox enables or disables the scheduling feature, which is another method to define the data extraction interval

Checkbox

No

Schedule

Another method to specify the frequency at which data is extracted, this allows data to be collected on a schedule using a mechanism similar to the SM37 batch job scheduling system

Prompt

No

Job

Status indicator to show whether the job that is created when the schedule mechanism is used, is scheduled correctly (and operating correctly)

Icon

No

AS Instance

Allows the collection of this EVENT_TYPE to be forced to be collected on a specific SAP instance (this should not be configured unless there is a reason to do so, generally this should normally be left blank)

Text

No

Splunk Index

Specifies the index in which this data should be saved to in the Splunk indexer. You can direct each EVENT_TYPE to a different index, but they must all be send to the same group of indexers, you can no direct an EVENT_TYPE to a specific indexer, only to a specific index

Text

No

Active

This checkbox activates and deactivates the data extraction for the particular event

Checkbox

Yes

Category

This is a metadata tag, which is used to categorize the event and it’s use i.e. Performance, Database, Security, ITSI

Text

No

Enable/Disable Data Extraction

To enable data extraction for a particular event, ensure that the “Active” field is checked for the row corresponding to the Group Definition.

To disable data extraction for a particular event, ensure that the “Active” field is unchecked for the row corresponding to the Group Definition.

Important Note: It is recommended that you stop all PowerConnnect batch jobs prior to making configuration changes to the Group Def.

 

Modify Data Extraction Interval

To modify the data extraction interval for a particular event, change the value in the “Suspend Interval” field to correspond with the number of seconds at which you would like to extract data (e.g. 3600 would mean every hour).

Important Note: It is recommended that you stop all PowerConnnect batch jobs prior to making configuration changes to the Group Def.