james-chou / sapninja Goto Github PK

Request that the ZPLUNK_ST03N_FRONTEND is extended to return the IP Address 
associated with the hostname, in the same way that ZPLUNK_SM04USR does

What steps will reproduce the problem?
1.Go to the last section which is Perl extractors on Windows
2.Install all required softwares and follow the mentioned steps in installation 
guide.
3. Fire nmake, you will get the compilation error.

What is the expected output? What do you see instead?
No compilation error, I see compilation error instead.

What version of the product are you using? On what operating system?
Windows 7

Please provide any additional information below.

We would like to have a dataset collected for SM20 audit logs

We have noticed that the collector stores transient information in the 
ZPLUNK_PARAMS table, which is constantly changing and therefore suggests it is 
not suitable for buffering.

Please update your documentation to change the buffer setting for this table to 
"Buffering not allowed"

For consistency with SM21's output, please modify the output of ZPLUNK_GET 
function to return the SM20 audit message within double-quotes.

We enter values for CCMS MTE keys into ZPLUNK_CCMS_MTES for capture using 
screen SM30.  When we check the entries, they are converted to complete to all 
uppercase like "R3SPOOLQUEUELENGTH" when we really intended to enter 
"R3SpoolQueueLength"

The collector is CASE-SENSITIVE and will not pick up the values of this MTE in 
ZPLUNK_CCMS_C.  We have been able to work around this by inserting the 
mixed-case value at the database level, but we would like advice on how to get 
SM30 to behave properly for this table.

We have maintained MTE key values in table ZPLUNK_CCMS_MTES.

The ZPLUNK_CAPTURE program is only returning observations from the central 
instance host.

I would like the SM50 dataset to be extended to contain the reason code.

Function ZPLUNK_GET short dumps because the documentation provided is missing 
the definition of function ZFORMAT_SIGN.

[deleted issue]

Very minor enhancement.

The ZPLUNK_GET function should be modified to process the output lines from the 
internal table rather than from within the SELECT-ENDSELECT cursor to reduce 
lock times.  I haven't yet seen contention with the collector as a result of 
this, but it should be improved if we can.

A user submitted the following list of corrections and enhancements to be made 
to the installation manual (thanks Leo Ng from CE Aus)

1.  After creating function group ZPLUNK_FGRP, right click the function group 
and click Activate

2.  Include instructions on where to enter short description, data type, length 
and label values when creating data types ... as well as when to save and 
activate.

3.  Change data type ZPLUNK_TXT12 data type label name to TEXT12

4.  When creating tables, add reminder to add to ZPLUNK package when prompted 
and to activate the table.  Also include instructions to ignore warning "Key 
length > 120 (Restricted functionality)" if it comes up during activation.

5.  Include instructions to generate a table maintenance screen for table 
ZPLUNK_CCMS_MTES

6.  The fields in table SM21 do not match the program (raised as issue 8) and 
are flatly wrong and do not work.

7.  Under METHOD PARAMETERS for CHECKLOCK, fix spelling of EXPIRY_DAET to 
EXPIRY_DATE

8.  Under METHOD CODE for CHECKLOCK, hange KEYPAIRT to CHECKLOCK,  Make similar 
corrections to LOCK, UNLOCK, TIMESTAMP, CCMS_MTE_TOUCH, CCMS_MTE_GETTIME and 
CONV_SECS_SINCE_EPOCH methods.

9.  For include programs, after importing source code, click save then activate 
then green arrow back

10.  Publish a friendlier link to the source code that can be more easily 
downloaded, with a prefix of 
"http://sapninja.googlecode.com/svn/trunk/splunk/".  Add a note that You can 
right click and save all source code files from the following link:  
http://sapninja.googlecode.com/svn/trunk/splunk/

Program short dumps because function module ZPLUNK_NSLOOKUP is missing.

The documentation contains problems for table ZPLUNK_SM21.  The field MODE is 
not allowed and another field is duplicated.

There is a short dump when executing the SM21 collector under NW70

This is due to the the program header statement of SAPMSM21 spanning 5 lines 
under this version, rather than 2 under later versions.  The fix is to remove 
the extra lines from the modified code of ZPLUNKSAPMSM21 as created by include 
ZPLUNK0007.  The fix will be released in version 1.03 but is listed as follows

...
    MODIFY MTAB_PROGRAM_SOURCE INDEX 1 FROM 'PROGRAM ZPLUNKSAPMSM21 MESSAGE-ID SL NO STANDARD PAGE HEADING.'.
    MODIFY MTAB_PROGRAM_SOURCE INDEX 2 FROM ''.
    MODIFY MTAB_PROGRAM_SOURCE INDEX 3 FROM ''.
    MODIFY MTAB_PROGRAM_SOURCE INDEX 4 FROM ''.
    MODIFY MTAB_PROGRAM_SOURCE INDEX 5 FROM ''.
...

[deleted issue]

The ZPLUNK_CCMS_C table contains observations values, but the ZPLUNK_GET 
function does not return the obervation value for field "obs" properly.

eg.
08/31/2011 11:25:00 
saphost=tsthost;sysname=TST;sysnr=00;mteclass=R3MemMgmtEsAct;severity=G;msg="OK"
;obs=;obs_uom=%

If a remote system is forwarding saposcol data to the collector system using 
SAPCCMSR, then this data appears in RZ20. 

However, even though the MTE is marked for collection, only local application 
server data is captured.

In the installation manual, the link to the ZPLUNK0010 source is wrong.

Change
http://sapninja.googlecode.com/svn/trunk/splunk/inc_zplunk00010.txt

To
http://sapninja.googlecode.com/svn/trunk/splunk/inc_zplunk0010.txt