CDPOS (Draft)

Data Description

The CDPOS event is used in SAP to view the change documents associated with changes to a business object in the SAP system.

Potential Use Cases

This event could be used in the following scenarios:

• Identify and alert on changes, which could create compliance concerns

• Dashboard and alert on total change volume for specific critical tables.

Metric Filters

Important Note: Data will not be extracted until the Metric Filter is configured.

Log into the managed system, and execute the /n/bnwvs/main transaction. Then go to Administrator → Metric filters → Change doc. filter.

Click on the New Entries button to add additional values. Define the filter header records by indicating Change document object, Transaction code, Description (wildcards are supported). Selection type should be “CDPOS table”. Save.

Then define the list of tables to select changes from by selecting filter header record and double-click on ‘Tables to select from’ node on the left panel.

Key field name and ‘Is master’ fields should be empty/ignored. Active flag should be set, otherwise table will be ignored at run time. 

For each table it is possible to define list of fields to be extracted (wildcards are supported). Add the desired entries by selecting the New Entries button, and enter the desired parameters. Highlight the table of interest and double-click on the “Field values to get” option.

Click the New Entries button and add new field values.

Save all settings.

Splunk Event

CDPOS with EVENT_SUBTYPE=””

Important Note: Data will not be extracted until the Metric Filter is configured.

The event will look like this in Splunk:

CDPOS with EVENT_SUBTYPE=”CDPOS”

Important Note: Data will not be extracted until the Metric Filter is configured.

The event will look like this in Splunk:

SAP Navigation

CDPOS with EVENT_SUBTYPE=””

Important Note: Data will not be extracted until the Metric Filter is configured.

Log into the managed system, and execute the SE16 transaction code. Then enter CDPOS in the Table Name field, and hit the Enter key.

Then enter the desired user selection parameters, and hit the Execute button.

The information displayed will match the data that is extracted and sent to Splunk.

CDPOS with EVENT_SUBTYPE=”CDPOS”

Important Note: Data will not be extracted until the Metric Filter is configured.

Log into the managed system, and execute the SE16 transaction code. Then enter CDPOS in the Table Name field, and hit the Enter key.

Then enter the desired user selection parameters, and hit the Execute button.

The information displayed will match the data that is extracted and sent to Splunk.

Field Mapping

CDPOS with EVENT_SUBTYPE=””

CDPOS with EVENT_SUBTYPE=”CDPOS”