Hello SAP has a module called CCMS which uses a transaction monitor (GUI) using RZ20. My question is - has anyone taken the transaction logs that can be viewed using RZ20 and fed them into Splunk?
You can download the PowerConnect app from SplunkBase to solve your issue. However, you'll have to purchase a license for the add-on that sits on the SAP server. Depending on where you're located you can either purchase a license and support through RHONDOS or BNW directly.
RHONDOS - Rhondos.com
BNW - http://www.powerconnect.io/contact-us/
YouTube video on how PowerConnect works: https://youtu.be/s-76bGvRMPE
Again, PowerConnect is the ONLY SAP-certified app that sits in the SAP ABAP layer and pushes data into Splunk.
YouTubeYouTube | RHONDOS - SAP and Splunk with PowerConnect
Introducing PowerConnect for SAP and Splunk by BNW and RHONDOS!!!
CCMS (and far more!!) data can be retrieved from SAP via the SAPninja data collection framework and then indexed into Splunk via RFC or direct file indexing. Please refer to this answer for further discussion