Data description
The Sales Orders extractor collects SAP sales order documents — header data from table VBAK together with the corresponding line items from table VBAP — and sends them to Splunk as a single event per sales order with the items nested inside the header record.
The extractor captures both:
-
Newly created sales orders — selected from VBAK by creation date/time (
ERDAT/ERZET) within the collection time window. -
Changed sales orders — detected via change documents (table CDHDR, object class
VERKBELEG, change indicatorU) within the collection time window.
Each event carries a CHANGE_IND field so that inserts (I) and updates (U) can be distinguished in Splunk.
Item lines are enriched with the material description (MAKTX from table MAKT, in the system logon language) and the billing date (FKDAT from table VBKD).
Data is collected under the subgroup SO.
Note: The extractor runs only on systems where table VBAK exists (ECC / S/4HANA). On systems without VBAK (e.g. SAP BW, SolMan) it exits without collecting data.
Potential use cases
-
Monitor sales order creation volume and value across sales organizations in near real time.
-
Track changes made to existing sales orders (who changed what and when) and alert on unusual change activity.
-
Analyze order pipeline by document type, sales organization, distribution channel, division, or customer.
-
Detect stuck or blocked orders using delivery block (
LIFSK), billing block (FAKSK), and overall status fields (GBSTK,LFSTK,ABSTK). -
Combine header and item data to report on material-level demand, net values, quantities, and rejected items (
ABGRU).
Setup
The following parameters are available:
|
Parameter |
Default |
Description |
|---|---|---|
|
|
(empty = all) |
Comma-separated list of sales organizations to collect, e.g. |
|
|
|
Controls which date/time pair is written to the |
|
|
|
Number of sales order headers processed per package (database |
|
|
|
Maximum number of VBAP items nested into a single sales order event. |
Extracted fields and data structure
Each emitted record is a deep (nested) structure: sales order header fields at the top level and an ITEMS table containing the line items of that order.
Event-level (technical) fields
|
Field |
Source |
Description |
|---|---|---|
|
|
calculated |
Event timestamp in UTC. For inserts: order creation date/time ( |
|
|
calculated |
|
|
|
CDHDR |
Change document date. Filled for update events only. |
|
|
CDHDR |
Change document time. Filled for update events only. |
|
|
nested table |
Line items of the sales order (see item structure below). |
Header fields (table VBAK)
|
Field |
Description |
|---|---|
|
|
Sales document number |
|
|
Date on which the record was created |
|
|
Time at which the record was created |
|
|
Name of the user who created the object |
|
|
Date of last change |
|
|
Document date (order date) |
|
|
SD document category |
|
|
Transaction group |
|
|
Sales document type |
|
|
Order reason |
|
|
Net value of the sales order in document currency |
|
|
SD document currency |
|
|
Sales organization |
|
|
Distribution channel |
|
|
Division |
|
|
Sales group |
|
|
Sales office |
|
|
Sold-to party (customer number) |
|
|
Cost center |
|
|
Delivery block (document header) |
|
|
Billing block (document header) |
|
|
Overall processing status of the document |
|
|
Overall rejection status |
|
|
Delivery status |
|
|
Customer groups 1–5 |
|
|
Customer purchase order number |
|
|
Customer purchase order date |
|
|
Requested delivery date |
|
|
Exchange rate for price determination |
|
|
Terms of payment key |
|
|
Incoterms part 1 |
|
|
Incoterms part 2 |
|
|
All customer-specific append fields (fields whose names start with |
Item fields (nested ITEMS table, table VBAP)
|
Field |
Description |
|---|---|
|
|
Sales document number |
|
|
Sales document item number |
|
|
Material number |
|
|
Material entered |
|
|
Material group |
|
|
Short text for sales order item |
|
|
Sales document item category |
|
|
Plant (delivering plant) |
|
|
Storage location |
|
|
Net value of the item in document currency |
|
|
SD document currency |
|
|
Cumulative order quantity in sales units |
|
|
Base unit of measure |
|
|
Sales unit |
|
|
Numerator (factor) for conversion of sales quantity into SKU |
|
|
Denominator (divisor) for conversion of sales quantity into SKU |
|
|
Gross weight of the item |
|
|
Net weight of the item |
|
|
Weight unit |
|
|
Originating document |
|
|
Originating item |
|
|
Document number of the reference document |
|
|
Item number of the reference item |
|
|
Complete reference indicator |
|
|
Route |
|
|
Date on which the item was created |
|
|
Name of the user who created the item |
|
|
Time at which the item was created |
|
|
Net price |
|
|
Condition pricing unit |
|
|
Date of last change |
|
|
Profit center |
|
|
Material groups 1–5 |
|
|
Reason for rejection of sales documents |
|
|
Item credit price |
|
|
Item is relevant for credit check indicator |
|
|
Credit data exchange rate |
|
|
Target quantity in sales units |
|
|
Target quantity unit of measure |
|
|
All customer-specific append fields (fields whose names start with |
Item enrichment fields
|
Field |
Source |
Description |
|---|---|---|
|
|
MAKT |
Material description in the system logon language |
|
|
VBKD |
Billing date of the item (from sales document business data) |
Example event
{
"TIMESTAMP": "20260805063212",
"CHANGE_IND": "I",
"VBELN": "0000012345",
"ERDAT": "20260805",
"ERZET": "063212",
"ERNAM": "JSMITH",
"AUDAT": "20260805",
"VBTYP": "C",
"AUART": "TA",
"NETWR": "1500.00",
"WAERK": "EUR",
"VKORG": "1000",
"VTWEG": "10",
"SPART": "00",
"KUNNR": "0000100001",
"GBSTK": "A",
"LFSTK": "A",
"BSTNK": "PO-778812",
"VDATU": "20260812",
"ZTERM": "0001",
"INCO1": "EXW",
"UDATE": "",
"UTIME": "",
"ITEMS": [
{
"VBELN": "0000012345",
"POSNR": "000010",
"MATNR": "MAT-100",
"MAKTX": "Ball bearing 20mm",
"MATKL": "001",
"PSTYV": "TAN",
"WERKS": "1000",
"NETWR": "1000.00",
"WAERK": "EUR",
"KWMENG": "100.000",
"VRKME": "PC",
"NETPR": "10.00",
"FKDAT": "20260812"
},
{
"VBELN": "0000012345",
"POSNR": "000020",
"MATNR": "MAT-200",
"MAKTX": "Shaft seal 35mm",
"MATKL": "001",
"PSTYV": "TAN",
"WERKS": "1000",
"NETWR": "500.00",
"WAERK": "EUR",
"KWMENG": "50.000",
"VRKME": "PC",
"NETPR": "10.00",
"FKDAT": "20260812"
}
]
}