An ITSI for SAP Content Pack... SAP Data in Splunk? (October 2022)

Here at RHONDOS, we’re constantly delivering Splunk ITSI projects geared towards monitoring SAP by leveraging Splunk’s Service Intelligence for SAP app (known as SI4SAP or SISAP). As we move from one successful project to the next, we’ve amassed a store of insights and reusable components that help us fast-track the implementation for SI4SAP and deliver on common use cases. We’ve been leveraging it internally for some time and polishing it as we go along.

Now, we ask ourselves: why should we have all the fun when we can share benefits with other users? As an experienced ITSI architect, it's my pleasure to introduce the RHONDOS SAP ITSI content pack, soon to be available on Splunkbase.

For those of you that are new to Splunking SAP data, let’s start with answering the “why.” By design, the SAP ERP contains a tremendous amount of information regarding the state of the business. It is an excellent system designed to get day-to-day things done to keep the business running. But what about when you want to create Big Data reports and analytics to leverage years of business data?

That’s where Splunk comes in as software that’s specifically designed to consolidate all the day-to-day business and performance data for the purposes of reports, analytics, insights or monitoring. You might ask, why can’t SAP do both? While technically possible, there will be compromises. It’s already very difficult for a company to build excellent software for a specific field or purpose, and if it’s now targeted at more than one field or one purpose, it’s exponentially more difficult to excel. “Jack of all trades, master of none” they say…

SAP is the best in ERP software. In fact, it’s been around since the early ‘70s and is a true powerhouse at what it does. The issue is that while business operations don’t evolve that quickly, technology does. When it comes to innovation, you can only turn a ship the size of SAP’s ERP in very deliberate and conservative increments. When it comes to modern features that we are well-accustomed to using in other products, you’ll find SAP ERP just isn’t there yet; it’s constantly in a state of catching up.

When you are looking for modern solutions for Big Data, SAP cannot deliver the best answer yet—not like Splunk can—and that’s why we want to Splunk SAP.

Shameless plug: If you are interested in Splunking SAP data, look at this other blog post that I authored.

Introduction (What is SI4SAP?)

If you are already familiar with Splunk, then you know that it set the standard in Big Data platforms for real-time, actionable insights. It’s a superb choice when delivering reporting, analytics or monitoring. Just like SAP has its central place in many companies’ business processes, Splunk has been made a central piece of many companies’ data strategies. Add to that the many product offerings Splunk has made available to further leverage data—like IT Service Intelligence (ITSI)—and it becomes clear why Splunk ITSI is a great candidate for your SAP data.

It’s no surprise that Splunk released Splunk Service Intelligence for SAP Solutions (SI4SAP) to give you a jump start on leveraging the SAP data that relies on the PowerConnect add-on which acts as a transporter between SAP and Splunk. You might be wondering how SI4SAP fits into the picture, so here’s a diagram:

And this is what SI4SAP looks like out-of-the-box:

SI4SAP provides multiple views into your SAP environments to help you diagnose and prevent issues as soon as possible. In other words, it helps you cut SAP downtime and keeps the business processes flowing. I have implemented SI4SAP for multiple clients and it’s great to see how it gives them visibility into their SAP environments after scarcely spending half an hour of setup time. You will have immediate access to dashboards, structured visualizations, and the KPIs that power it all.

So SI4SAP looks pretty good, right? But, as with any analytics and monitoring solution, all the visualizations and alerting are only as good as the thresholding beneath them, so this is an area where a lot of time is spent after the initial setup is completed. This is where you adapt SI4SAP to your specific SAP landscape to get actionable alerts instead of simply a lot of noise. For example, the number of failed transactions is something you will want to alert on but based on what is historically abnormal in your SAP system. The selection of critical KPIs and their thresholding is typically done in cycles where you execute an analysis of the baseline performance, tune accordingly, and then observe the quality of the alerts outputted. You execute this process multiple times to get to a point where you have concise alerts with minimal false positives and false negatives.

This is a visualization of the process I've described. Like many other things, observability is a path, not a destination, so keep in mind you’ll need to execute this process multiple times until you can get it production-ready:

No matter how tedious, don’t hurry through these steps as you don’t want a solution that produces too many false alerts or misses important alerts in production.

This where our RHONDOS SAP ITSI Content pack comes in. Concise alerting is critical to reducing downtime, but very time-consuming, so we at RHONDOS have created content as a companion for SI4SAP that takes you through the entire KPI selection and tuning process as quickly as possible. It shows you all the information you need to select and configure appropriate thresholds in one place, as doing this without our content pack would be tedious and repetitive.

RHONDOS’ SI4SAP content pack is designed to get you production-ready alerts as soon as possible by efficiently guiding you through the process of KPI selection, importance level setting, baseline analysis and threshold selection, as well as alerting logic configuration.

Additionally, an important feature in our content pack is the streamlined alerting logic built into it. If you enable the default alerting that comes out of the box in SI4SAP, you will get untriaged alerts without much context. For example, if you have an application server failure, you will get a flood of alerts as SI4SAP recognizes that there are seemingly multiple failures even though they all have one root cause – the application server.

Another example would be if you needed to group alerts by some other context like the geographical location or business unit it belongs to, you would then need to manually build that logic using the SPL query language. Thankfully, our content pack includes the built-in functionality needed to deliver aggregated and contextualized alerting to hit the ground running. I hate to say I told you so, but I told you that you’d love the RHONDOS SAP ITSI content pack.

As if that were not enough, there is even more functionality on the way that will also be released soon.

To sum things up, to quickly leverage SI4SAP, you’ll need the Splunk and SAP expertise to configure it to your exact needs. RHONDOS has that combined experience, plus our SAP ITSI content pack so that you can truly benefit from the implementation of Big Data on your SAP landscape.

About the author: @Roman Lopez — rlopez@rhondos.com

Roman Lopez is a Sr. Splunk consultant specializing in ITSI at RHONDOS. With over 10 years’ experience in Splunk he enjoys new challenges and delivering on custom requirements. Roman has authored other influential articles in the ITSI world, such as the appropriately-titled Splunk ITSI Veteran Explains ITSI Essentials: Don’t stoop down, Service Up!

Assuming you’ve already signed up to get notified for when our SI4SAP content pack is released on Splunkbase, the next step could be checking out our ITSI page!