Overview


Installing PowerConnect for Splunk

Install & Configuring Splunk Enterprise server


Installing Splunk Server

Install the Splunk Enterprise server according to the standard instructions. Generic install instructions are below.
Start by downloading and executing the splunk installer.


Click Install.


Splunk is now installed.

Install & Configuring Splunk Enterprise server

Login for first time

When you finish installing Splunk it will launch a browser and as you to log in and change the Admin password.
Login using
user: admin
pw: changeme

And change the password

Splunk is now installed and running

Create an upload user

We need to create a user that SAP can use to upload data to Splunk

Click on Settings -> Access Controls

Click on users

Create a new user

Enter user name sap_upload

Add it to the administrators group

Set a password

And click save

Import the PowerConnect for Splunk application

Next we need to import the PowerConnect for Splunk application in to the Splunk server. This can be obtained from your local reseller.

Click on Apps -> Manage Apps

Click on the Install App from file

Click on browse and select the PowerConnect for Splunk APP .tar.gz file

Select the checkbox [ ] Upgrade app. if PowerConnect for Splunk is already installed

Click Upload button

The app is now installed

Create an index for SAP to upload data

Select Settings -> Indexes

Click on New Index button in the top right corner

Give the index a name (sap) and set the default application to to PowerConnect for Splunk

Click on Save

Index now exists

Create a Role to control access to different indexes

Click on Roles

Click on Roles

Click on New

Create role sap and select Default app BNW-app-powerconnect

Multiple roles can be created and you can control access to different indexes by assigning them to different roles.

Click Save

Create a user to access the PowerConnect for Splunk application

Create a new user

Enter user name sap_user, and ensure the Default app is set to PowerConnect for Splunk

Add it to the sap group

Set a password

And click save

Assign Indexes to Role

To ensure Splunk searches the new index we have created we need to assign the sap group to the new index.

Click on Roles

Click on Roles

Click on sap role

Scroll down to the Indexes Searched by Default and Indexes section

And add the sap index to the list of searchable indexes for all users in the role Users

Click Save

Finalising

Now we have installed Splunk and created a user for SAP to use to upload the data, and an index for the SAP data
to go in to. We also have a user to use to connect to Splunk to view the data.
We also have a user to use to connect to Splunk to view the data.

Installation ABAP


Installation steps

Installation of PowerConnect for Splunk requires the following steps to be completed in the order listed below.
1. If you wish to use HTTPS / SSL connection between SAP and Splunk please setup the SSL support in the ABAP
engine using the steps listed here. (link to Setting up HTTPS / SSL support).
2. Import the agent using TMS / SAINT
3. Start the PowerConnect for Splunk control panel in SAP using tcode /BNWVS/VS
4. Configure the connection between SAP and Splunk
5. Import the Splunk application into the Splunk Server
6. Advanced Topics: Configuring SAP to connect to more than 1 Splunk server
7. Advanced Topics: Round Robin versus Load Balanced

Setting up HTTPS / SSL support in SAP

By default, Splunk restAPI listens on port 8089 in with SSL active. SAP supports SSL however some basic setup is needed to provide SSL functionality to the native HTTP client built in to the ICM to support HTTPS. You can disable SSL support in Splunk and use HTTP without SSL to communicate between SAP and Splunk however it is not recommended for a production environment, especially where Splunk traffic traverses a shared network or in a public or private cloud hosted solution for SAP or Splunk.If you wish to enable SSL support in SAP ABAP please follow the steps below.Please note that the instructions below are for setting up SSL to Splunk with a default configuration that includes a self-signed certificate that is included into Splunk during installation.

Important Note(s):
If your Splunk Enterprise Server has a custom SSL certificate installed, the process is the same, however names you see in the examples will differ from the screen shots below.

If you connect to a Splunk server via a proxy server then you will need to install any certificates that may sign HTTPS requests that flow through it into SAP.

If you are unsure about how to configure SSL, or you get SSL chain-verify or peer verify errors in SAP log a support call. You will need a valid license and support agreement to get email and phone support.

Ensure that System environment variable SECUDIR is set, this normally points to the /usr/sap///sec directory.
If further details are required for setting environment variables please refer to SAP OSS Note 1827566 -Download the latest SAP Crypro library from SAP Marketplace and unpack into the instance executable directory
http://support.sap.com/swdc -> Support Packages and Patches -> My Application Components ->
SAPCRYPTOLIB.In transaction RZ10 set the following profile parameters into the Default.pfl profile parameters. A restart of you SAP system is required after saving updated profile.

Profile ParameterValueExamples
ssl/ssl_libPath and file name of the SAP Cryptographic LibraryUNIX: /usr/sap//SYS/exe/run/libsapcrypto.so Windows NT: :\usr\sap\\SYS\exe\run\sapcrypto.dll
sec/libsapsecuPath and file name of the SAP Cryptographic LibraryUNIX: /usr/sap//SYS/exe/run/libsapcrypto.so Windows NT: :\usr\sap\\SYS\exe\run\sapcrypto.dll
ssf/ssfapi_libPath and file name of the SAP Cryptographic LibraryUNIX: /usr/sap//SYS/exe/run/libsapcrypto.so Windows NT: :\usr\sap\\SYS\exe\run\sapcrypto.dll
ssf/nameSAPSECULIBSAPSECULIB
icm/server_port_PROT=HTTPS, PORT=, TIMEOUT=PROT=HTTPS, PORT=1443, TIMEOUT=90

In transaction STRUSTSSO2 activate the following SSL nodes:

  • SSL Server Standard
  • SSL Client SSL Client (Anonymous)
  • SSL Client SSL Client (Standard)

Activate by right clicking on each node and selecting “Create” – The default entry can be used unless specific security policies must be adhered too.

Change Mode ->

Next we need to ensure the ROOT CA (or server self signed certificate is installed in the ABAP system)
Start by connecting to the Splunk server on port 8089 using HTTPS this will show you the certificate in use.

Open the ceritifcate information

This certificate is signed by the SplunkCommonCA and we need to import this CommonCA certificate into SAP so it trusts the certificate being issued by the Splunk server.

To do this highlight the SplunkCommonCA certificate and click View Certificate

Not we are looking at the SplunkCommonCA certificate that is the issuer of the certificate being send by Splunk. If we configure SAP to trust this certificate then it will also trust the certificates it has issued which include the one being sent to SAP by the Splunk Server (SplunkServerDefaultCert).

Next click Copy to file to export this certificate

Now we need to import this certificate into SAP. Start tcode STRUSTSSO2

Highlight the host anme under node “SSL client SSL Client (Standard)

Click on the import button in the certificate section.

Now enter the file path of the SplunkCommonCertificate saved in the previous step

Now enter the file path of the SplunkCommonCertificate saved in the previous step

Now the SplunkCommonCA certificate appears in the Certificate section, click on the Add to Certificate List
button to add it to the Certificate List

Click Save in the toolbar to save this change

Repeat this change for the following 2 nodes

SSL server Standard

SSL client SSL Client (Anonymous)

Importing the agent using SAINT

Save the PowerConnect Install and Support Package locally to your PC.

Login to client 000 and go to transaction SAINT

Load new package into SAP

Select Installation Package -> Load Packages -> From Front End

Browse to where you have saved the Install package.

Select Open

Confirm Decompress

Select Start

Select BNWVS Add-on package

Select Continue

From the Support Package Tab select the BNWS support package using the dropdown.

Select continue

Select continue on next screen

Confirm there are no Modification Transports.

Use the Start Options button to change the job to run in background.

Confirm Change

Confirm again

Click the refresh button until the “Finish” button appears

Select Finish

The BNWVS Add-on will now be in list of installed Add-ons.

Activate BC Sets

Login into the default client and go to transaction SCPR20

Enter/BNWVS/BCSET

Click Activate BC Set

Create new transport

Create New Transport

Create Administrator Change Role

Transaction PFCG

In role enter Z_BNWVS_ADMIN_CHANGE

Select Single Role

Enter a description PowerConnect for Splunk Change Authorizations

Select Save

Select Authorization tab:

Select “Change Authorization Data”:

Select “Do not select templates”

Select “Manually button”

Add Authorization Objects S_TCODE and ZBNWVSADM

For “transaction code” click on change button and enter value /BNWVS/MAIN

Select Save

For “activity” code click on change button and enter value 02 (change)

Select Save

Select Save at top of screen and select

Select the generate button

Create Administrator Display Role

Transaction PFCG

In role enter Z_BNWVS_ADMIN_DISPLAY

Select Single Role

Enter a description PowerConnect for Splunk Display Authorizations

Select Save

Select Authorization tab:

Select “Change Authorization Data”:

Select “Do not select templates”

Select “Manually button”

Add Authorization Objects S_TCODE and ZBNWVSADM

For “transaction code” click on change button and enter value /BNWVS/MAIN

Select Save

For “activity” code click on change button and enter value 02 (change)

Select Save

Select save at top of screen and to confirm

Select the generate button and leave transaction

Starting PowerConnect for Splunk in SAP GUI

To start the PowerConnect for Splunk control panel in SAP call the tcode /BNWVS/MAIN

Configuring the connection between SAP and Splunk

When you run the Control Panel for the first time you will be prompted to setup a connection to the Splunk Server using a wizard. If you want to use SSL to connect between SAP and Splunk you should ensure HTTPS is setup before running the Splunk connection wizard.

Required authorization object: ZBNWVSADM, Activity: Change

When you first execute the PowerConnect for Splunk transaction code (/BNWVS/MAINS) you will be asked to accept the End User License Agreement. You need to read and click accept before you can continue.

Using the wizard to setup the connection you will need the following information:

Description: DEFAULT

URL of Splunk Server: https://SplunkServerDefaultCert:80891

Index name: sap

1 We have used the original SSL certificate installed in the Splunk Server which is called SplunkServerDefaultCert however your server hostname and it’s certificate common name may be different. You will also need to ensure whom ever has signed the certificate (Certificate CA) is installed in to SAP using tcode STRUSTSSO2.

Click on the tick and we need to

Description: USER1

User: sap_upload

Password: <password used when creating the sap_upload user>

Click on the tick

Connection to Splunk is now setup and if we click Connection Test we should see a successful connection

Click tick and we are asked for the setup jobs

Click on tick to confirm all of the jobs hare scheduled

And now PowerConnect for Splunk is setup and running!

Configuring SAP to talk to more than 1 Splunk Server

If you want to configure PowerConnect for Splunk to send it’s data to more than 1 Splunk Enterprise Server you can configure multiple servers to send the data to. Simply add the servers to the Splunk Setup then configure the distribution mechanism. There are 2 options for distribution

1. Round-Robin: Send the data to the servers using a round-robin mechanism that distributes the data across all configure and active Splunk servers by sending each collected metric to only 1 Splunk Server. If you have 2 Splunk server 50% of the data will be sent to 1 server, and 50% of the data will be sent to the other Splunk Server. In this mechanism you will need to configure Splunk to distribute the data between the Splunk Servers

2. All-Send:This mode sends all collected metrics to all servers. This is only useful for scenarios where you have Splunk Servers that are not sharing indexed data or where you need every Splunk Server to have a copy of every metric collected from SAP. For example, this is useful for testing new versions of Splunk, because you can setup a 2nd Splunk Server to send data to while the 1st Splunk Server is still operational.

To configure a sending to a 2nd Splunk Server:

First start by choosing a mechanism Round-Robin or All-send and update the global configuration:

Start the PowerConnect for Splunk application control panel in SAPGui using tcode/BNWVS/MAIN

Click on Administrator -> Setup Global Config

You will be presented with the global configuration parameters

Insert a new row into the table using the Insert Row icon

Add in a line with the following details:

Config Name: MULTI_SERVER_DISTRIBUTION

Config Value: ROUNDROBIN or SENDALL

Save this using the Save icon

Start the PowerConnect for Splunk application control panel in SAPGui using tcode/BNWVS/MAIN

Click on Administrator -> Setup Splunk

Click on Splunk System Details button

Click on the Create button

Enter the details of the 2nd Splunk Server, you will need to enter

Description: Server2

Splunk Server URL: This is the fully qualified hostname of the Splunk Server

Index: <index you want to store the SAP data into>

If you need to access the Splunk Server via a proxy server you can enter the proxy server details. This is optional

and only required if there is a proxy server between SAP and the Splunk Server.

Click OK

Your entry will now appear in the list of Splunk Servers

Click OK

Now we have saved the Splunk Server configuration we need to create a server entry, this is a combination of a Splunk Server definition (which we have just setup) and User Credentials.

If you have the same credentials as an existing user you can re-use them, otherwise setup the credentials by clicking on the Maintain Credentials button. You can follow the instructions in the section above on setting up the Credentials

Once you have credentials setup simply create a new active server entry by clicking on the Create button

Then select the

  • Server you created
  • Credentials you want to use to connect to this server
  • Check the [X] Active checkbox

From the pop up dialog box

Use the Connection Test button to ensure the connection to Splunk is working and the index is accessible

Once you click ok you will be presented with a list of Splunk Servers, and the new server will be on the list.

Any metric collected after this configuration is saved is automatically uses this new server using the distribution mechanism defined in the global configuration. If no distribution configuration is set, the default is Round-Robin

Installation Java


SAP PowerConnect Java Installation Instructions

Introduction

This document details the installation instructions for the SAP PowerConnect Java monitoring agent.

Prerequisites

SAP PowerConnect Java has the following requirements:

  • SAP NetWeaver 7.3 and above
  • 100 MB free disk space
  • Administrator access to the SAP NetWeaver system

Installation

The installation has the following high level steps:

  1. Installation of the software
    1. Sap PowerConnect Java monitoring agent
    2. Sap PowerConnect configuration GUI
  2. Configuration of Splunk
  3. Initialization of database table to store configuration
  4. Granting JMX security permissions
  5. Configuration of Sap PowerConnect Agent

Installing the Sap PowerConnect Java monitoring agent

To install the Sap PowerConnect Java monitoring agent perform the following steps:

  1. Acquire the PowerConnect agent from file from sap-powerconnect-java-X.X.sca BNW Consulting
  2. Deploy the .SCA using SAP Software Update Manager (SUM) and ensure its listening on port 1129

SAP PowerConnect Java Installation Instructions

Open a browser and connect to the Java SUM control page
https://<host>:1129/lmsl/sumjava/P75/index.html

SAP PowerConnect Java Installation Instructions

Enter <sid>adm credentials

SAP PowerConnect Java Installation Instructions

SAP PowerConnect Java Installation Instructions

Point SUM to the directory containing the PowerConnect for Java code

SAP PowerConnect Java Installation Instructions

Enter J2EE administrator credentials

SAP PowerConnect Java Installation Instructions

SAP PowerConnect Java Installation Instructions

SAP PowerConnect Java Installation Instructions

SAP PowerConnect Java Installation Instructions

SAP PowerConnect Java Installation Instructions

SAP PowerConnect Java Installation Instructions

SAP PowerConnect Java Installation Instructions

3. Once deployed the application should be visible in the SAP Netweaver console:
http://:5###00/nwa

SAP PowerConnect Java Installation Instructions

Search for bbramley

SAP PowerConnect Java Installation Instructions

And start the service

SAP PowerConnect Java Installation Instructions

Configuration of Splunk

The SAP PowerConnect monitoring agent sends its metrics and events to Splunk using the
Splunk HTTP Event Collector.

To configure the Splunk HTTP Event Collector (HEC) follow the documentation on the
Splunk website here:

http://docs.splunk.com/Documentation/SplunkCloud/6.6.0/Data/UsetheHTTPEventCollector

This should result in creating a HEC token for the SAP PowerConnect monitoring agent to use in the next section.

Granting JMX security permissions to the Sap PowerConnect Agent (NetWeaver 7.5)

If you are using NetWeaver 7.5 the Guest user account needs to have read permissions to JMX in order to consume metrics from SAP specific JMX beans.

To do this use the User Management section in the SAP Netweaver UI:

SAP PowerConnect Java Installation Instructions

In the Search Criteria dropdown choose Role then enter Guest and click Go:

SAP PowerConnect Java Installation Instructions

Click on the Guest user in the table and click on the Assigned Actions tab:

SAP PowerConnect Java Installation Instructions

Click Modify and in the Getd text box enter “JmxManageAll” then click Go.

SAP PowerConnect Java Installation Instructions

Select the JmxManageAll action at the top of the table and click Add, then Save.

Create a user ‘powerconnect’ set it to TechnicalUser.
Add a firstname to allow it to be saved, then add the following roles to the user.

SAP_XI_API_DEVELOP_J2EE
SAP_XI_API_DISPLAY_J2EE
NWA_READONLY;
SAP_XI_MONITOR_J2EE;

Configuration of Sap PowerConnect Agent

The final step is to use the Sap PowerConnect UI to configure the agent.

The URL to view the UI is:

http://:/webdynpro/resources/com.powerconnect5/spcj_wd/SapPowerConnectJava

The UI should look like this:

SAP PowerConnect Java Installation Instructions

If you get ERROR returned check that the Java services are running

General Tab
The configuration under the General tab can normally be left as default options.

Splunk Tab
Click the Splunk tab and configure the Splunk HEC details:

Configuration KeyDescription
Splunk HEC KeyThe token that you generated when configuring Splunk
Splunk HEC URLThe host and port of where the Splunk HEC is listening e.g. http://localhost:8088
Splunk IndexThe name of the index where you would like to store the SAP PowerConnect monitoring data
Splunk SourcetypeThe name you would like give to identify the SAP PowerConnect monitoring events (should usually be left as default)

Click the Save button.

Click the JMX tab to pick the events you would like to collect from the SAP Netweaver
system. By default the java.lang domain beans are collected.

Once configured events should start to appear in the JVM tab of the SAP PowerConnect for
Splunk app:

SAP PowerConnect Java Installation Instructions

JMX Tab
To enable monitoring of a specific JMX object simply search for the object and once you
have it in the top table, click on the down triangle to move it to the list of monitored jmx
objects and click save.

SAP PowerConnect Java Installation Instructions

PI Monitoring Tab
To monitor a specific PI channel in the PI monitoring tab you can enter the following
information

direction – “OUTBOUND,”INBOUND” or leave as NOT_CONFIGURED to monitor both directions
onlyFaultyMessages – <leave cleared>
recieverName – Enter the receiver name, or leave NOT_CONFIGURED to monitor all receivers
recieverParty – Enter the receiver party name, or leave NOT_CONFIGURED to monitor all receivers
senderName – Enter the sender name, or leave NOT_CONFIGURED to monitor all senders
senderParty – Enter the sender party name, or leave NOT_CONFIGURED to monitor all senders
status – Can be one of the following values “success”, “toBeDelivered”, “waiting”, “holding”, “delivering”, “systemError”, “canceled”, or leave NOT_CONFIGURED to monitor all statuses
messageType – Enter the message type name, or leave NOT_CONFIGURED to monitor all senders

Admin Tab
This tab shows the license key, license validity, amount of data sent to Splunk today

SAP PowerConnect Java Installation Instructions

Checking if the Java agent is deployed correctly

The easiest way to check to see if the agent is really running is to hit the following url:
http://:/sap_powerconnect_java-1.0.0-SNAPSHOT-standalone/

It should ask for the administrator credentials then will return a version message:

Checking the java agent is deployed correctly

If there is a 404 not found or some sort of error instead then it means the agent has not been fully deployed.

Starting PowerConnect for Splunk in a Browser

Upgrading


Applying ABAP Support Packages

Go to transaction /n/BNWVS/VS

Confirm current version of PowerConnect for Splunk and Metric Collection and Uploader are running

Stop Collector

Click on Toggle uploader to stop uploads

Select refresh scene until confirmation Collection and Uploader have stopped

Logon to client 000 and go to transaction SPAM

Upload support package from PC

Support Package Load Packages From Front End

Browse to saved location of support package

Select Open

Confirm Decompress

Select Define Queue

Select “All Components”

Use dropdown to select latest BNWVS Support Package and select “Calculate Queue”

Confirm Queue

Select No for Modification Adjustment Transports

Select Import

Use “Start Options” to change to run in Background

Select refresh until the confirm queue option is available

Select the confirm queue button

Before reactivating jobs go to “Activing BC Sets” chapter and follow the activation process which will activate any new configuration

After successful import return to transaction /n/BNWVS/MAIN

Start Collector

Select Toggle Uploader

Select refresh scene until confirmation Collection and Uploader have started

Updating SAP PowerConnect Java connector using SUM

Start SUM

Updating SAP PowerConnect Java connector using SUM

Open the browser to access the SUM control

Updating SAP PowerConnect Java connector using SUM

Updating SAP PowerConnect Java connector using SUM

Updating SAP PowerConnect Java connector using SUM

Updating SAP PowerConnect Java connector using SUM

  • Select Manually prepared directory
  • Select directory that contains the PowerConnect .SCA fil

Updating SAP PowerConnect Java connector using SUM

Updating SAP PowerConnect Java connector using SUM

Updating SAP PowerConnect Java connector using SUM

Updating SAP PowerConnect Java connector using SUM

Updating SAP PowerConnect Java connector using SUM

Updating SAP PowerConnect Java connector using SUM

Updating SAP PowerConnect Java connector using SUM

Platform Support Matrix


ABAP

Tested on all SAP versions NetWeaver 7.01, 7.02, 7.03, 7.30, 7.31, 7.50 & S/4 HANA 1610, 1709, 1809.

Notes:

1 – testing against base version 7.30 and implied support for subsequent minor releases like 7.31 with the same JVM version.

Splunk

Tested on Splunk Enterprise 6.1, 6.2, 6.3, 6.4, 6.5, 6.6, 7.0, 7.1, 7.2.