KB 073 – Adding SM37 batch job logs
KB073 – Adding batch job logs and spool to the data sent from tcode SM37
Batch job logs can be sent from SAP to Splunk so long as there is a batch job filter that matches the batch job name you want to monitor the logs for. Wildcards are supported.
Open the Administrator -> Metric Filter -> SM37 job filter
Add in a jobname (wildcards are supported, ‘*’ means all jobs) and check either
- Finished(Log) – All finished jobs that match the Job name filter have their logs sent to Splunk
- Cancelled(Log) – All cancelled jobs that match the Job name filter have their logs sent to Splunk
- Finished(Spool) – All finished jobs that match the Job name filter have their spool sent to Splunk
- Cancelled(Spool) – All cancelled jobs that match the Job name filter have their logs sent to Splunk
Please find sample of Splunk events below:
Job log (EVENT_SUBTYPE=LOGS)
Job spool (EVENT_SUBTYPE=SPOOL)
In both cases above SEQNUM field can be used as a line index to build the output in right order.