KB073 – Adding batch job logs to the data sent from tcode SM37
Batch job logs can be sent from SAP to Splunk so long as there is a batch job filter that matches the batch job name you want to monitor the logs for. Wildcards are supported.
Open the Administrator -> Metric Filter -> SM37 job filter
Add in a jobname (wildcards are supported, ‘*’ means all jobs) and check either
IsFinished – All finished jobs that match the JobName filter have their logs sent to Splunk
IsCanceled – All cancelled jobs that match the Jobname filter have their logs sent to Splunk