icon/x Created with Sketch.

Splunk Cookie Policy

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website. Learn more (including how to update your settings) here.
Accept Cookie Policy

Accept License Agreements

This app is provided by a third party and your right to use the app is in accordance with the license provided by that third-party licensor. Splunk is not responsible for any third-party apps and does not provide any warranty or support. If you have any questions, complaints or claims with respect to this app, please contact the licensor directly.

Thank You

Downloading SAP PowerConnect for Splunk
SHA256 checksum (sap-powerconnect-for-splunk_630.tgz) fa99adc3a25b8bfa5a63e4297a17625356b58f9f9ea9143a0f8ca259a79245be SHA256 checksum (sap-powerconnect-for-splunk_620.tgz) 9aa3df5d543e40d622c04cb7081ea468f74f15b550fcfaada324bda4b8425557 SHA256 checksum (sap-powerconnect-for-splunk_610.tgz) 59302f2d28e70d7c40149ab368a2a3e0621c727e5d5cdc500acb30d718b9bdd3 SHA256 checksum (sap-powerconnect-for-splunk_600.tgz) 31f636a88d18eb344897dcb48e4ff27ef9afe356fe1b02370d34b4e30caf3129 SHA256 checksum (sap-powerconnect-for-splunk_502.tgz) 783b9b3f7d7183da5062362b3195fd8cb25f0587480d75d6eb593f1b84808ca4 SHA256 checksum (sap-powerconnect-for-splunk_501.tgz) 2abab8c0e095f065674d1d7ff88c8c8f84c93f57e86d06eaadaf0549c4a3ce5b SHA256 checksum (sap-powerconnect-for-splunk_500.tgz) 86ea541057a1281735aac587537a2d9f45f024218a6c234c49d8456f2772f5f2 SHA256 checksum (sap-powerconnect-for-splunk_4200.tgz) cf43139c80867e73a15f9336e714fd2a0a396979e06673d329817759392ba4f9 SHA256 checksum (sap-powerconnect-for-splunk_4112.tgz) 916e999a14f1f22368f32314c13bfa1862c5c84bbfb8a2afbba71b933fb5b03d SHA256 checksum (sap-powerconnect-for-splunk_4111.tgz) b4358dc9f82f339a99212460ac46f3ec8471c283b84d69cb27b73edcc31a65e5 SHA256 checksum (sap-powerconnect-for-splunk_4110.tgz) dc8db8f1f771ff641b781b06e1c1bfa3a2365e5f4a9dce0ba4cd89922ab7f8a6 SHA256 checksum (sap-powerconnect-for-splunk_4100.tgz) 7d53827f1ddf5a67d9cd3ea715dba6e45ea88296c49a570bb1131fadd90a355f SHA256 checksum (sap-powerconnect-for-splunk_409.tgz) af645c3f30aaa15dd2a9109f65e679452e5dbb128ee786f483557886538e1b3a SHA256 checksum (sap-powerconnect-for-splunk_408.tgz) 48a9b8f1b10f6a7a535864e29d7e0df0e61a68e781840906c3885ad8f41230f3 SHA256 checksum (sap-powerconnect-for-splunk_405.tgz) 95181c42cb0335e70b799d31f9006210b45244d3036a88e6f1eeecb0b969b79b SHA256 checksum (sap-powerconnect-for-splunk_404.zip) 25da88cf62fcf8c899b4829d4a16a2761ec230a37405b2f44d63d161beee3360
To install your download
For instructions specific to your download, click the Details tab after closing this window.

Flag As Inappropriate

SAP PowerConnect for Splunk

Splunk AppInspect Passed
Admins: Please read about Splunk Enterprise 8.0 and the Python 2.7 end-of-life changes and impact on apps and upgradeshere.
An SAP certified product that installs into NetWeaver ABAP, S/4 HANA, NetWeaver Java, SAP Cloud Platform or TomCat Java based SAP systems and uploads events directly to Splunk Enterprise or Splunk Cloud in real time.

SAP PowerConnect for Splunk


This Splunk application helps in visualizing and monitoring SAP systems with PowerConnect for Splunk ABAP based application for SAP. This application is standalone and does not depend on any other technology add-ons.

  • Author - Brave New World Consulting Pty Ltd
  • Creates Index - False
  • Source type - sap:abap, sap:java
  • Compatible with:
    PowerConnect for Splunk using Netweaver ABAP: 7.01 - 7.50, HANA: All versions, Netweaver Java, Tomcat
    OS: Platform independent




  • This application needs to be installed on Splunk Search Head in the case of Distributed environment.
  • For Installation and Setup instructions, refer to the documentation here - https://www.powerconnect.io/install-steps/
  • This app can be installed either through UI from "Manage Apps" or by extracting the compressed file into $SPLUNK_HOME$/etc/apps folder.
  • Restart Splunk
  • For existing installations, if you are upgrading the app, please clear browser cache and hit <SplunkServer>/_bump URL to prevent Splunk from using cached objects.


  • After performing above mentioned installation steps, configure the indexes to be accessible by admin and all other users and roles who will be accessing this application.
  • All SAP raw events are configured to provide TIMESTAMPs in UTC timezone. Configure system and Splunk user timezone accordingly.
  • Make sure the there is no stanza of [sap_abap] in props.conf inside Splunk's or Application's default or local folders. If any field extraction is required to be done in props.conf for the [sap_abap] stanza, please verify the application is not affected.
  • Run all the savedsearches with suffix " - Run Once Only" manually so as to populate the Lookups from existing event data. In case of large number of events, if savedsearch execution does not get completed, try to reduce the time range and populate the lookups. This step is required to be performed only once as there are separate savedsearches scheduled to run every hour for appending new items to existing lookups from new events.


  • Data Model Acceleration is disabled by default. Admin can enable acceleration and set the acceleration period by the following steps:
    1. On Splunk's menu bar, Click on Settings -> Data models
    2. From the list for Data models, click "Edit" in the "Action" column of the row for the Data model for which acceleration needs to be enabled.
    3. From the list of actions select Edit Acceleration. This will display the pop-up menu for Edit Acceleration.
    4. Check Accelerate check box to "Enable" data model acceleration.
    5. If acceleration is enabled, select the summary range to specify acceleration period.
    6. To save acceleration changes click on save button.


  • In case there is no need to use the already indexed accelerated Data Model, the Data Model can be configured to rebuild from scratch for the specified acceleration period. Data Model can be rebuilt by the following steps:
    1. On Splunk's menu bar, Click on Settings -> Data models
    2. From the list for Data models, expand the row by clicking ">" arrow in the first column of the row for the Data model for which acceleration needs to be rebuild. This will display an extra Data Model information in "Acceleration" section.
    3. From the "Acceleration" section click on "Rebuild" link.
    4. Monitor the status of the rebuild in the field "Status" of "Acceleration" section. Reload the page to get latest rebuild status.


  • Below savedsearches are accelerated and acceleration might increase storage and processing costs. This savedsearches are used in Dropdown population in all dashboards.
    1. Global STAD - Database Time, Response Time & Network Time
    2. SAP_stad_get_userlist
    3. summaryAccountInstance
    4. summaryAccountSource
    5. summaryInstanceId
    6. summarySourceId
    7. summaryTcodeInstance
    8. summaryTcodeSource
    9. summaryTypeInstance
    10. summaryTypeSource
  • User can change acceleration option by following below steps.
    1. On Splunk's menu bar, Click on Settings -> Searches, reports, and alerts.
    2. Select App context="SAP PowerConnect for Splunk (BNW-app-powerconnect)" and mark check "Show only objects created in this app context".
    3. Click on savedsearch which you want to edit.
    4. Under Acceleration label, you will find "Accelerate this search" check box.
    5. By making check / uncheck "Accelerate this search" check box, acceleration option of savedsearch will be enabled/disabled.


  • In SAP Global - > Client Version dashboard, for Splunk Enterprise v6.3.2, the Pie Chart does not show "No Results Found" if the SAP System parameter is changed and data is not available for SAP System. This is a Splunk issue as it works properly in other versions of Splunk Enterprise.
  • In Splunk versions 6.3.x, If larger time range is selected in dashboards then the dashboards will show error " JournalSliceDirectory: Cannot seek to 0". This is a known issue in Splunk. Here is the link to JIRA: https://jira.splunk.com/browse/SPL-117780
  • Time Machine dashboard, would have compatiablity issue on Splunk Versions 6.2x, 6.3.x, and 6.4.x.
  • Audit and Security Checks dashboard search event handlers for counting “No. of Checks Passed” and “No. of Checks Failed” will not work in Splunk versions 6.2.x, 6.3.x and 6.4.x.


  • HTTP Event Collector(HEC) is a fast and efficient way to send data to Splunk Enterprise and Splunk Cloud. Notably, HEC enables you to send data over HTTP (or HTTPS) directly to Splunk Enterprise or Splunk Cloud from your application. Also, HEC is token-based, so you never need to hard-code your Splunk Enterprise or Splunk Cloud credentials in your app or supporting files like the way it is required in data collection using REST API.
  • So it is recommended to use HEC instead of REST API to send data to Splunk.



  • In "SAP Global->User Experience (Geo)" dashboard, ip_subnets lookup file is used for fetching predefined subnet, lat ,long and text fields. On the basis of these fields, "Number of logged in users (Geo)" panel will display bubbles on Geo Map.
  • To make "SAP Global->User Experience (Geo)" dashboard working properly, user needs to be manually insert subnet values in ip_subnets lookup file ($SPLUNK_HOME$/etc/apps/BNW-app-powerconnect/lookups/ip_subnets.csv).
    For example:
    subnet,lat,long,text // this line is already in ip_subnets.csv file.
    XXX.XXX.XXX,-10.000,20.000,"Text Value" //Sample value in ip_subnets.csv file.
            - "XXX.XXX.XXX" is subnet value.
            - "-10.000" is latitude.
            - "20.000" is longitude.
            - "Text Value" is identical city/state/state name.


Look ups can be rebuilt by the following steps:
a. On Splunk's menu bar, Click on Settings -> Searches, reports, and alerts
b. In "App context" dropdown, select "SAP PowerConnect for Splunk (BNW-app-powerconnect)" from the list.
c. Select check box of "Show only objects created in this app context"
d. In the top right search box, enter "- Run Once Only" and click on search icon
e. Above list of look up saved searches should be filtered out.
f. Now for each saved search from the above list, click on "Actions" -> "Run" one by one in new tabs
g. The saved searches will run with "All Time" time range. In case, you want to update the time range with some lesser value stop the existing search job, change the time range and run the search again.
NOTE: Run the saved searches one by one to avoid concurrency issue

Copyright (c) 2020 bnwconsulting.com.au. All Rights Reserved.

Release Notes

Version 6.3.0
Oct. 9, 2020

• New! Extractor Status for ABAP dashboards
• New! Landscape Component Information
• New! Landscape Last Event Received
• New! Wizard for New SAP SIDs and Instances Discovery
• New! HANA Audits
• New! HANA Memory Usage
• New! HANA Services
• New! HANA Threads
• New! SAP Cloud - CPI Messages
• New! SAP Process Chain Dashboard
• Improved! Mapping: Dashboards with Event Types (SAP Group Definition)
• Improved! SAP Security Scorecard
• Improved! Extractor Status
• Improved! Batch Jobs
• Improved! ABAP Dumps
• Improved! PI Messages
• Improved! Channel Monitoring
• Improved! HANA Alert Details
• Fixed! System Overview : Updated “CPU(%), Memory(%), Availability(%), WP-BTC(%), WP-DIA(%)”panels
• Fixed! SAP Security Essentials: Updated "Users with sensitive roles" title drill-down link and “Password expiration policy” panel
• Other minor improvements

UPGRADE INSTRUCTIONS: https://www.powerconnect.io/wiki/kb-093-splunk-app-upgrade-guide-for-sap-powerconnect-app-6-x/

Version 6.2.0
June 11, 2020

New! SAP User User Behavior Analysis with MLTK
New! Login permissions and change events
New! Risk Assessment Dashboard
Updated! System Overview
Updated! Mapping : Dashboards with SAP Group Definition (with live extractor status)
Updated! ABAP Dumps (now with MLTK)
Updated ! Batch Jobs (with new UI)
New! Weekly Usage Statistics
New! Extractor Status
New! Certificate Status
New! SAP Logs Search
Other minor improvements on Landscape Overview, SAP Security Scorecard, Users Logged in, Audited Logins, User Experience (Geo), Batch Jobs Analysis by Instance, Help menu links and others.

Upgrade instructions: https://www.powerconnect.io/wiki/kb-093-splunk-app-upgrade-guide-for-sap-powerconnect-app-6-x/

HOTFIX : https://www.powerconnect.io/wiki/kb-098-cpu-memory-and-availability-gauges-displaying-0-values-v-6-2-0-bug/

Version 6.1.0
March 13, 2020

Now supports Splunk 8.0 and Python 3.

New! Application Logs (SLG1).
New! SAP Directories (AL11).
New! Workload monitor stats for ST03 - RFC and Web Services
New! Workload monitor stats for ST03 - User Profile
New! Mapping - Event Types :: SAP Group Definition
New! Oracle - Tablespace Growth
Updated! Time Machine Dashboard
Updated! Batch Jobs
Updated! User Experience (Geo)
Updated! ABAP Dumps
Updated! CPU vs. Work Processes
Added! Additional use cases for System Overview, SAP Security Essentials and SAP Security Scorecard dashboards

Upgrade instructions: https://www.powerconnect.io/wiki/kb-093-install-upgrade-guide-for-sap-powerconnect-for-splunk-6-1-0/

Version 6.0.0
Sept. 17, 2019

Biggest splunk app update ever for PowerConnect.
• New! SAP Security Essentials (with out-of-the-box audit reports)
• New! System Overview Dashboard (new landing page, view current status with last 24 hours history at the same time).
• New! Dark Theme and Intuitive Navigation Bar (re-categorized menu options).
• New! Thread Hotspots (SAP Java).
• New! Expensive Statements (Database)
• New! Segments (Database)
• New! MyDashboard – with Drag and Drop function (Beta).
• New! Data Dictionary Dashboard.
• Updated! Number Range Monitoring.
• Updated! IDOC for WE02.
• Fixed! Landscape overview – capacity utilization.

Version 5.0.2
May 29, 2019

• New! Audit and Security Checks dashboard (added under SAP Global.)
• New! Time Machine Dashboard (added under SAP Global).
• New! Background Job Analysis dashboard (added under SAP Instance).
• New! Number Range Monitoring dashboard (added under SAP Global).
• New! SAP CCMS dashboard (added under SAP Global).
• Updated! Batch Jobs dashboard (under SAP Global )
- Added "Jobs Runtime", "Job Steps and Logs for JOBNAME", "Runtime for JOBNAME over last 7 days", "SM50 Logs for INSTANCENAME" and "Job Log Data for JOBLOG"
- Added drilldowns in "Jobs Runtime" and "Active Jobs Runtime"
• Updated! Added timerange and source filters in Channel Monitoring dashboard.
• Updated! Renamed macro `jmx` to `sap-java` across all java dashboards for consistency.
• Improved! "Page Hit Rate", "Page Response Time", "Channel Monitoring" dashboards.
• Improved! App improvements made for better cloud vetting score.

Version 5.0.1
Feb. 13, 2019

* Changed regex in the SAP_Production_Systems data-model to extract AVAIL_PERCET field from both kinds of data, having spaces after colon(:) and without spaces after colon in the raw events.
• props.conf and tags.conf files added to make the data compatible with CIM Authentication Data-model.
• Channel Monitoring Dashboard added under JAVA > PI.
• App icons updated.
• Resolved issue in Audited Logins dashboard.
• Resolved issue in Memory Pressure panel in SAP Systems dashboard.
• Changed queries for DIA Steps dashboard to utilise time field from raw data.
• Active job runtime panel added in SAP Global > Batch Jobs dashboard. Added scheduled saved search to populate lookup for threshold of batch jobs runtime.
• Active locks duration panel added in SAP Global > Locks dashboard.
• Batch Jobs Runtime Alert - Alert added for Batch Jobs runtime exceeding threshold value for runtime.
• Resolve App Inspect failure.

Version 5.0.0
Aug. 3, 2018

Setup page for Time range and Span filter.
Setup page for all database related dashboard. User can hide particular dashboard, if needed.
Top navigation menu changes

Version 4.20.0
March 30, 2018

Added a panel for Check for "Old" locks inside dashboard Locks and Updates under SAP Global.
Added a dashboard for System Logs under SAP Global.
Added a dashboard for Spool Monitoring under SAP Global.
Added a dashboard for System Settings under SAP Global.
Added a dashboard for SAP Connect under SAP Global.

Version 4.11.2
Oct. 10, 2017

* Version 4.11.2 (Oct 2017)
Removed transaction_slabs.csv lookup which was not used in app.
Resolved AppInspect issue of ip_subnets.csv lookup.
Resolved AppInspect issue of conf files having default or global stanza.
Resolved AppInspect issue of Data Model acceleration should be disabled by default. Steps to enable acceleration is mentioned in Data Model Configuration section below.

Version 4.11.1
Sept. 16, 2017

* Version 4.11.1 (Sep 2017)
Changed timesUTC flag to false for Availability Gantt chart so that the chart populates according to user's browser's timezone.
Added a new field INSTANCE_NAME for EVENT_TYPE ST03_TIME, SM51, ST06 in Datamodel.
Added a dropdown of Span varying from 1m to 7d and based on this span selection all the panels will change except event status drilldown chart in SAP Production Systems dashboard.
Removed DBMT, FNEMT and TOTAL_RESP_TIME from SAP Production Systems Performance Drill down Response Time chart and showed the chart by Instance Name.
Made JVM dashboard compatible with new event format.
Added a new SAP Global Transactions (Raw) dashboard.
Added a Page Response Time (ms) dashboard.
Added a Page Hit Rate dashboard.
Added Java View, CPU Load, Free Physical Memory (MB) and Free Swap Memory (MB) panels to JVM Dahsboard.

Version 4.11.0
Sept. 4, 2017

* Version 4.11.0
Updated SAP_Production_Systems DataModel for "CPU All Instances" Dashboard.
Added "CPU All Intstances" Dashboard in SAP Global.
Added DataModel for SAP_ABAP_SM37 operation.
Added a job picker and a panel for SM37 jobs' average execution time in "Batch Jobs" Dashboard under SAP Global.
Added CPU All Instances Dashboard in SAP Global.
Changed timesUTC flag to false for Availability Gantt chart so that the chart populates according to user's browser's timezone.
Added a new field INSTANCE_NAME for EVENT_TYPE ST03_TIME, SM51, ST06 in Datamodel.
Added a dropdown of Span varying from 1m to 7d and based on this span selection all the panels will change except event status drilldown chart in SAP Production Systems dashboard.
Removed DBMT, FNEMT and TOTAL_RESP_TIME from SAP Production Systems Performance Drill down Response Time chart and showed the chart by Instance Name.
Made JVM dashboard compatible with new event format.
Added a new SAP Global Transactions (Raw) dashboard.

Version 4.10.0
July 18, 2017

* Version 4.10.0-1
Javascript enhancements. Check Installation section of this document for more instructions.
Added "Event Status" column and a drill down chart in "SAP Production System" dashboard.
Added a new "CPU vs. Work Processes" dashboard.
Modified regex for Availability in datamodel for "SAP Production System" to support all Splunk versions above 6.2.x.
Modified "SAP RZ10", "SAP Global Transactions" and "SAP Instance Transactions" dashboards to support Splunk 6.2.x.
Panel title changes in "Disk" and "HANA" dashboards.
Bug fix in "DIA Steps (Total)" and "DIA Steps" dashboards which showed negative values in charts.
Bug fix in "DB/2" dashboard by modified search queries.

Version 4.0.9
March 28, 2017

* Version 4.0.9-1
Added HANA DB Reports:
1. Overview
2. Alert Details
3. SQLPL Details
Added ASE Dashboards:
1. Log Details
2. Database Details
3. Computation Usage Details
4. DeviceIO Details
5. Resource Details
6. SpinLock/System State Details
7. System Action Details
Added IDOC Status for WE02 Dashboard in SAP Global
Added Multiple Sourcetype in Macro: sap_abap, sap:abap, sap:abap:<event_type>
Changed jmx macro to support both the sourcetype : jmx, sap:java

Version 4.0.8
Feb. 23, 2017

* Version 4.0.8-2
Modified the lookup query that is used to populate SAP system instance dropdown.
Added new saved searches to run once manually after installing app to populate lookups from all event data. Added a step in Configuration section below.
Fixed Availability REGEXP inside Datamodel
Added a new Dashboard of "SAP Production Systems" as a default dashboard.
Added a new Dashboard of "SAP CRM BSP Transactions".
Added a new Dashboard of "SAP RZ10".
Resolved issue of Blank TCODEs for Task Type Dialog
Add Drill Downs in all charts of "SAP Global STAD" and "STAD by Instance" dashboards.
Moved "Errors in PowerConnect Application Log" panel below "PowerConnect Messages received" in PowerConnect Health dashboard
Removed timezone and timestamp field configuration from props.conf.
Move field extractions from props.conf to search queries.
Updated app to use _time field instead of TIMESTAMP field.
Resolved issue with Task Dropdown default.

Version 4.0.5
May 11, 2016

All SAP System and SAP Instance form input dropdown will use Saved Search
Added a pre-configured role "pc-admin"
Added a new dashboard "IDOC Status" under SAP Global Navigation Menu
Added description in app.conf
Removed usage of deprecated <seed> option in Simple XML forms.
Cleanup of savedsearches.conf and minor fixes

Version 4.0.4
May 8, 2016


Subscribe Share

AppInspect Tooling

Splunk AppInspect evaluates Splunk apps against a set of Splunk-defined criteria to assess the validity and security of an app package and components.

Are you a developer?

As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps and add-ons from Splunk, our partners and our community. Find an app or add-on for most any data source and user need, or simply create your own with help from our developer portal.

Follow Us:
© 2005-2020 Splunk Inc. All rights reserved.
Splunk®, Splunk>®, Listen to Your Data®, The Engine for Machine Data®, Hunk®, Splunk Cloud™, Splunk Light™, SPL™ and Splunk MINT™ are trademarks and registered trademarks of Splunk Inc. in the United States and other countries. All other brand names, product names, or trademarks belong to their respective owners.