Does anyone have field definitions that decipher the SAP SAL that could be shared?

[afx]

Hi,
does anyone have field defintions that decipher the SAP SAL that could be shared?
I find lots of references to commercial SAP - Splunk Integration product which I am not too keen to use. But no information that explains the structure of the 200 character records and the fields it contains.
I only the the SAL for my purposes, but currently it is too much guesswork to use it reliably.
thx
afx

[frank_buchholz]

I wonder if anybody ever has created a module for splunk which calls the remote function RSAU_API_GET_LOG_DATA in the SAP systems instead of reading the audit files.

Greetings
Frank

[cquinney]

You can download the PowerConnect app from SplunkBase, it comes with an SAP Dictionary that explains what each field means and preconfigured queries just for security purposes. However, to ingest your SAP data from its server you'll have to purchase a license for the add-on that'll need to sit on the SAP server.

Depending on where you're located you can either purchase a license through RHONDOS or BNW directly.
RHONDOS - Rhondos.com
BNW - http://www.powerconnect.io/contact-us/
YouTube video on how PowerConnect works: https://youtu.be/s-76bGvRMPE

PowerConnect is the only Splunk SAP-certified app.

[afx]

Yes, I have seen the app, but I explicitly do not want to install anything in SAP itself.
Menawhile I do have a good solution:
https://answers.splunk.com/answers/757714/how-to-splunk-the-sap-security-audit-log.html#answer-75953...
cheers
afx

[afx]

Still have no good definition, but at least I found a link explaining the file format:
https://blogs.sap.com/2014/12/11/analysis-and-recommended-settings-of-the-security-audit-log-sm19-sm...

Posting it here for reference.