KB 022 – Prepare Splunk for SP06 – Remove source type

Prepare Splunk for SP06 – Remove source type

Please note that SAP PowerConnect add-on is compatible only with PowerConnect for Splunk 4.06.

1. Delete definition of sourcetype sap_abap

The definition of sourcetype sap_abap is not needed anymore because PowerConnect for Splunk sends events that Splunk can automatically parse without definition of the sourcetype.

Please note that the sourcetype used is still called sap_abap but the sourcetype does not need any definition in props.conf.

1.1. Find the location of the definition of sourcetype sap_abap

1.1.1. Login to Splunk server
You need to login with user account that allows you to modify props.conf in Splunk folder.

1.1.2. Run command prompt / command shell as administrator

1.1.3. Goto bin directory
cd {$SPLUNK_HOME}\bin

1.1.4. Find all props.conf which each attribute definition of sourcetype sap_abap comes from
.\splunk.execmd btool props list sap_abap –debug

Prepare Splunk for SP06 – Remove source type

1.2. Removethe definition of sourcetype sap_abap

1.2.1. Located the definition

Using the example above, goto the following
c:\Program Files\Splunk\etc\apps\BNW-app-powerconnect\default\props.conf

1.2.2. Open the file and locate sap_abap

Prepare Splunk for SP06 – Remove source type

Delete the definition & all attributes

Prepare Splunk for SP06 – Remove source type

1.2.3. Run command in 3.1.4 again.

Prepare Splunk for SP06 – Remove source type

Usually the definition exists in the following files

– $SPLUNK_HOME\etc\apps\BNW-app-powerconnect\defaults\props.conf
– $SPLUNK_HOME\etc\system\local\props.conf

1.2.4. Repeat until the command does not return the definition

Prepare Splunk for SP06 – Remove source type

1.2.5. Restart Splunk system

Download PDF version here