Viewing SAP Operations Through a Single Pane of Glass with Splunk

⇨ Monitoring data for has become an increasingly complex endeavor.

⇨ Organizations want end-to-end visibility into applications, systems and business service health.

⇨ SoftwareONE and Splunk combined to create a toolkit that gives users a single unified view with context.

Monitoring data for SAP operations: systems, applications, and products has become an increasingly complex endeavor. It’s important for SAP customers to get this right. As companies are growing organically and through mergers and acquisitions, the number of systems and applications they take on is multiplying. IT landscapes are becoming more diverse, complicated, dynamic, and highly scalable. A sole SAP shop is a rarity these days. Instead, a mishmash of SAP and non-SAP applications — both on-premise and in the cloud — is more common.

A typical SAP customer often has a landscape that includes SAP Enterprise Resource Planning (ERP), SAP NetWeaver, Java systems, and Salesforce, as well as SAP Ariba with custom procurement workflows mixed with non-SAP solutions for cybersecurity and a configure, price, quote (CPQ) system in the cloud. Some are already running SAP S/4HANA or have an upgrade or migration plan to move to a hyper-scaler-hosted cloud environment.

IT teams have huge amounts of data that need to be monitored, with parts in SAP systems, parts in non-SAP applications, parts in their own data center, and parts in the cloud. Whatever the scenario, Chief Information Officers (CIOs), IT operations leaders, and line-of-business owners are looking for a new way to monitor these complex landscapes. It’s no longer workable for an IT organization to have 20 or more monitoring tools running in siloed environments with different people seeing only a certain scope of data in a vacuum. IT administrators, developers, analysts, systems administrators and anyone else invested in the company’s health’s SAP landscape want and need a simpler, more integrated solution that provides a bigger picture view of all their data.

What SAP Customers Are Asking For

This desire for end-to-end visibility into applications, systems, and business service health is universal. Organizations want choices, and they don’t want to be locked into one vendor. SAP customers today look very different from what they did in years past. Teams using SAP today prioritize freedom of choice and security. They expect automation and visibility of their entire landscape with integration across all of their applications, systems, and services, regardless of whether they are SAP or non-SAP. And they want to reduce their IT spending.

IT teams don’t just want to know that a system went down or what processes are running long. What’s more helpful is gaining business insights about what’s happening in the landscape — from the database and application layer to the network and infrastructure layer — and how the dependent business services, transactions, and components of the SAP landscape are affected.

IT teams need to predict problems before customers are affected and prevent damage to the brand and revenue. In order to accomplish this, they need to monitor the complete cycle of business processes such as order to cash, buy to pay, or hire to retire, which may include not only SAP but multiple non-SAP systems and integration components.

Specific lines of business in an enterprise that correspond SAP areas may include someone in procurement who looks at SAP Ariba solutions, someone in human resources who looks at SAP SuccessFactors solutions, or someone in finance who looks at the SAP ERP system. Each one needs a specific view that provides visibility with context. With a big-picture view, these teams will see not just where things are going wrong but also why they are going wrong and what can be done to prevent the problem from occurring.

SAP customers need to understand what’s truly going on with their systems and business processes to ensure performance and security. To achieve this, they need to take information from diverse systems such as delivery data combined with financial data and currency conversions, and push that into a monitoring platform where they can also look at other business data simultaneously. They want to correlate non-SAP data from network, firewall, and cloud logs all in the same place. Historically, there was no way to monitor non-SAP data together with SAP data. While SAP Solution Manager is an effective tool for monitoring SAP systems, it only monitors SAP data and holds that data for a limited time.

Imagine if there were a single dashboard that could cover an organization’s SAP and non-SAP systems — load balancers, middleware, firewalls, and cloud metrics — and provide visibility across end-to-end business processes. What if one solution could deliver what SAP customers are asking for?

A Single Unified View with Context

Since 2016, a platform has been available for SAP customers that addresses all these customer requests. In a joint venture between SoftwareONE and Splunk, there is a solution for SAP customers to have end-to-end visibility in their entire IT landscape via a mechanism that correlates SAP and non-SAP data from disparate systems. The framework is provided by Splunk as part of its observability solution portfolio. Here’s how it works. SoftwareONE’s PowerConnect collector resides inside SAP systems as an SAP-Certified add-on. This collector extracts high-fidelity SAP data through the use of 24/7 standard SAP function modules, reports, and tables. PowerConnect has powerful time stamping and filtering functionality to help support detailed reporting. The data transfer is secured via SSL and can then be correlated with any other non-SAP data sources in Splunk and Splunk Service Intelligence for SAP solutions.

“We combined our dataset and Splunk’s presentation layer, and together, they are quite a powerful semantic toolkit,” said Warwick Chai, Director of SAP Technology and Innovation at SoftwareONE. “It surfaces lots of data, correlates it all together, and puts graphs, charts, and key performance indicators (KPIs) on a dashboard where you can set alerts, flashing lights, and alarm bells all on one screen. All this in what would have taken 20 screens to do before — after much digging around.”

SAP customers are challenged simply by the sheer amount of data they monitor. “We have some customers in Splunk who ingest four, five or six petabytes of data a day, while several others are ingesting just four, six or eight terabytes a day,” Chai said. “Splunk’s been very successful at producing collective frameworks or agents for collecting a lot of non-SAP data and combining and correlating the data to really dial up the effectiveness, efficiency, and utility of that data.”

When PowerConnect and Splunk Service Intelligence for SAP are installed, 956 SAP use-case scenarios and 450 adaptive thresholds KPIs are provided out of the box. Because the solution provides a holistic view of customers to monitor SAP and non-SAP data in the same platform, it eliminates the war-room kind of finger-pointing situation that previously would have occurred, according to Pradeep Bhatt, SoftwareONE’s Global Product Manager for PowerConnect, who said, “Monitoring with Splunk can give the visibility of where the issue is across all the infrastructure, all the applications — and quickly, to get into the root cause analysis.”

Tapan Shah, Principal Product Manager – Observability for IT at Splunk, said that Splunk Service Intelligence for SAP not only natively monitors IT health but also ingests and analyzes monitoring data from other tools to “provide a more aggregated single-pane-of-glass view.” He added, “We provide specific insights— through the lens of business — into why one problem is more important than another. Our platform provides the business impact associated with a problem being troubleshooted. We monitor the complete SAP deployment, end-to-end, and we connect that to the rest of the IT infrastructure in context.”

Monitoring all business processes and IT administrative tasks through one pane of glass via Splunk’s Service Intelligence for SAP solution provides predictive services health scores, machine learning-driven insights, and artificial intelligence-directed troubleshooting. SAP customers can thus detect issues earlier and prevent negative effects on their business.

Benefits of One Pane of Glass

According to Gene Kaalsen, SAP Solution Strategist at Splunk, a major value statement for the solution is that it eliminates siloed monitoring. “We can simultaneously reduce cost and increase revenue by consolidating all the security, operational, business, and infrastructure monitoring tools across your environment — through the entire stack — into a single platform.” In addition, there is a host of other benefits that Splunk offers to SAP customers.

Near-Real-Time Responses: There’s no more waiting for batch updates. Splunk collects data in near real-time. Users can set custom intervals for data collection or follow the provided recommendations for the predefined collection frequency. According to Bhatt, some customers have configured the tool to collect SAP security data every five minutes, while SAP business data is collected every 30 seconds.

Extended Data Retention: The collected SAP data can be either archived or deleted in SAP, which saves SAP database space. For example, sending 50 GB of data per day to Splunk frees up a lot of space in the SAP system. “We can keep that data in Splunk for as long as you choose,” said Kaalsen. “You can compare today’s data with data from two years ago.”

Historical/Forensic Analytics: Other siloed monitoring tools may monitor the current infrastructure but cannot monitor user behavior such as logins, permissions and change events. If there was a data breach six months ago, Splunk can reveal what happened — what systems were accessed, what programs were run, what transactions were used, what data was viewed, and precisely what the business impact was.

Replicated Data for Auditing: Data can be kept for years in Splunk for auditing purposes. This replication acts as a centralized audit log — a secondary source of truth — that only the audit team can access, which SAP administrators can’t corrupt, manipulate, or delete. Kaalsen said, “We can automate the complete security audit, so when the auditors come, you can point them to the SAP Security Scorecard Dashboard in Splunk containing everything they need to complete the Audit and Compliance process.”

Dynamic Security Alerts: Automated processes can be set to lock out users that trigger security alerts when some anomalous user behavior happened. That includes users logging in from a foreign country, someone running a transaction they haven’t run before (such as a Basis user running a finance transaction) or someone downloading a file they shouldn’t have access to. If dynamic alerting is turned up, the alert noise gets suppressed as opposed to having a barrage of thousands of alerts coming in every day.

SAP Cloud Migration Upgrade Visibility: Splunk gives customers visibility into all SAP and non-SAP-dependent components in the environment during Blueprint to establish a baseline and benchmark all KPIs. “During a migration, we continue to monitor the system health and compare application, integration, database and system KPIs across source and destination instances from one point in time to another. You can visualize issues from yesterday compared to the issues picked up today,” Kaalsen said. “Then, after the migration, our solution really comes to life in ongoing AI and ML-driven SAP Service Observability in production.

Customizable/Extensible: While PowerConnect and Splunk are ready to go out of the box, they also give customers the flexibility to extend them with custom tables and programs and change configurations for data collection and alerts.

SAP-Certified: Each year, the solution receives multiple certifications that cover much of the SAP solution set such as SAP ERP, SAP S/4HANA, SAP S/4HANA Cloud, RISE with SAP, and SAP Enterprise Cloud. Currently, the solution has 10 SAP certifications.

Industry-Agnostic Use Cases

For any typical business process that contains 10 steps, chances are that three steps are executed outside of an SAP system, traversing various integrations. Regardless of what industry that process is running in, similarities exist in standard processes, such as in finance and human resources. The business, security, and performance monitoring use cases for Splunk described below apply across most businesses and industries.

For example, one logistics company was experiencing issues with identifying missing packages and was dealing with the problem reactively. The shipping and tracking information was stored in custom tables within the SAP system, and the end-of-day batch-updated data extraction meant the business intelligence reporting wasn’t arriving until the next day. Now, with the near-real-time insight from Splunk, the business is dealing with any missing packages more proactively.

One media company needed Splunk visibility in its security operations center. Its SAP team had been running an audit every couple of months. In one audit, they found that someone had downloaded information from a database that they shouldn’t have. By the time it was discovered, that person had already left the company. This company now uses Splunk to monitor user behavior and unauthorized connections and has sensitive data protection and fraud detection in real-time.

One retail company was having issues in its distribution center with its inventory replenishment process for stores. The end-of-day batch processes were run overnight at the store level to identify what stock needed replenishing. These batch jobs would run long, and the information wasn’t getting to the distribution center workers fast enough for them to find, pick, and deliver the product. With Splunk, the distribution center workers now have more timely visibility into long-running processes based on anomaly detection. They can proactively respond to the issue before it affects the business. This ensures that the distribution center workers know precisely what merchandise they need to pick, where it’s located, and what truck it needs to go on so the correct merchandise can arrive in the retail store before opening hours the next morning.

One manufacturing company was losing hundreds of thousands of dollars while its trucks sat idle for hours waiting for its advanced shipping notification (ASN) documents to clear at the end destination. The approval process to match the truckload contents against the purchase order/invoice was a complicated one that involved many systems, some SAP and non-SAP. It involved getting data out of encrypted tables, an FTP server, and a mail gateway going through lots of interfaces. With Splunk, the company is saving all that wasted idling money because the ASN documents are already waiting when the trucks arrive at the end destination, and they can swiftly unpack their load and be on their way.

One transportation company was having issues that involved their buy-to-pay process, where batch-process issues created problems with the movement of their goods. Invoices from crucial suppliers were getting stuck in interfaces and batch processes. They are now using Splunk and can see everything inside the buy-to-pay business cycle, spot any issues immediately, and release purchase orders prioritized by value hours before month-end reporting so they don’t miss any deliveries.

Unbox Your Data

SAP customers aren’t just focusing on their SAP software. They want a more holistic view. While SAP systems are an important part of their landscapes, it’s just one piece of it. As Bhatt warned, “If you’re not correlating your SAP data with non-SAP data, you are missing out because you are not getting the right information about what’s happening in your entire business landscape.”

For more information on Splunk, visit their SAPinsider showcase page at: https://sapinsider.org/vendor-showcase/splunk/

For more information on SoftwareONE, visit their SAPinsider showcase page at: https://sapinsider.org/vendor-showcase/softwareone/