KB 197 (ABAP): PowerConnect Data from ABAP System Not Flowing to Splunk, What Should I Do?

Description

There may be occurrences when the data feed to Splunk is interrupted. In such scenarios, please follow the steps below to troubleshoot the reason why the data is not flowing as expected.

Step 1: Confirm PowerConnect Batch Jobs are Active

The initial troubleshooting step is to confirm that the PowerConnect batch jobs are running as expected. Please log into the PowerConnect admin console (transaction code: /n/bnwvs/main) in the system where PowerConnect is installed. Confirm the batch jobs are running as expected (i.e. green check marks for all three jobs).

Open

In case one of the batch jobs is stopped (i.e. see red X displayed below), please follow the Start steps noted in this KB article: https://powerconnect.atlassian.net/wiki/spaces/POW/pages/3333095438

Open

Step 2: Confirm Splunk Endpoint is Accessible

The second troubleshooting step is to confirm that the Splunk endpoint is accessible. You can do so by executing the PowerConnect transaction (/n/bnwvs/main) in the system where the data feed is interrupted and click on Administrator → Connection Setup → Upload Scheme. For customers using older versions of PowerConnect, the path will be Administrator → Splunk Setup → Upload Scheme.

From there, click the physical endpoint on the right side of the screen and perform a connection test.

If you receive an HTTP receive error, please review the setup noted in the following article: https://powerconnect.atlassian.net/wiki/pages/createpage.action?spaceKey=POW&title=Configuring%20PowerConnect%20Splunk%20Connection%20in%20SAP%20%28PowerConnect%20ABAP%208.X%29&linkCreation=true&fromPageId=3417243653 . The most common causes for an HTTP receive error include:

• Inputting the endpoint URL incorrectly.

• Inputting the incorrect index name.

• Inputting the incorrect HEC token.

If you receive an SSL connection error, please ensure that you have imported the latest valid certificate using the instructions noted here: https://powerconnect.atlassian.net/wiki/spaces/POW/pages/3426781238 . The most common causes for an SSL connection error include:

• Firewall change blocking connection from the SAP system to Splunk via port 443 or port 8088. To test this, log into the SAP server at the operating system level, and perform a telnet command using the following syntax: telnet <url> 443 if connecting via port 443 OR telnet <url> 8088 if connecting via port 8088. If there is a firewall issue, please reach out to your network team to fix the issue. PowerConnect support should not be contacted to remediate networking issues. Here are two telnet command examples:

  • telnet 172.1.0.61 8088

  • telnet softwareone.splunkcloud.com 443

• Not importing the client, intermediate, and root certificates into the appropriate note in the STRUST transaction. If you apply a valid client certificate, but have updated the root certificate, the latest root certificate needs to be imported using these instructions: https://powerconnect.atlassian.net/wiki/spaces/POW/pages/3426781238. Please note that PowerConnect support should not be contacted to update or generate SSL certificates.

• SSL certificate expiration for the Splunk endpoint. PowerConnect support should not be contacted to update or generate SSL certificates. You can update the SSL certificate using the following instructions:

  • How to acquire the latest Splunk certificate: https://powerconnect.atlassian.net/wiki/spaces/POW/pages/3012198249

  • How to update the SSL certificate in the SAP system: https://powerconnect.atlassian.net/wiki/spaces/POW/pages/3286007809

• If none of these steps meet your scenario, please export the ICM trace file for further analysis: https://powerconnect.atlassian.net/wiki/spaces/POW/pages/3092381901

Step 3: Confirm PowerConnect Roles and Authorization Objects are Up to Date

If you have recently performed an upgrade of the PowerConnect application, you may experience issues with collecting and sending data to Splunk if the upgrade was not performed correctly. To check if there are authorization failures, please execute the SU53 transaction, and switch to the user who executes the PowerConnect batch jobs.

If you see authorization object failures, please ensure that the PowerConnect roles and authorization objects are up to date by contacting your SAP Security team. To update them, please follow the steps denoted here: https://powerconnect.atlassian.net/wiki/spaces/POW/pages/3426780762 and https://powerconnect.atlassian.net/wiki/spaces/POW/pages/3426781010.

Step 4: Submit an Incident to Support

If you have completed the steps above and are still unable to establish a connection with Splunk, at this point you can submit an incident to support. If you are a PowerConnect customer via a partner, please raise a support ticket with that partner. If you are a direct customer with SoftwareOne, please follow the steps noted here: https://powerconnect.atlassian.net/wiki/spaces/POW/pages/3272998947. Connection issues are considered a P3/P4 incident, not a P1/P2 incident.

Important: When creating a PowerConnect support incident please submit screenshots or evidence of the previous steps completed in addition to the Troubleshooting information noted here: https://powerconnect.atlassian.net/wiki/spaces/POW/pages/3076227084 .

Product Version