Information sharing between enrichment policies with global variables

Global variables are structured records that maintain data values across all phases of event processing. You can use these variables in event enrichment policies for sharing information between events during event processing; any other type of variable (local) has a scope limited to the current policy.

Usage of global variables

You can use global variables in the following scenarios to:

• Filter event slots by using event operators with global variables. For more information about event operators, see Slot data types.
• Build conditions for processing events.
• Point to static text, event data (values of event slots), results of mathematical functions, and values of previously-defined variables in enrichment policies.
• Specify global variables in the external source file for the match and enrichment values for enriching events by using dynamic enrichment policies. For more information, see Specifying global variables in an external file.
• Filter events by using the event selection criteria. For more information, see Creating and enabling event policies.
• Specify notification settings while creating a notification policy. For more information, see Event-based notifications for alerting users.
• Set global variable attribute values in event enrichment policies. For more information, see Actions for advanced and time-based enrichment.
• Specify global variables in Enrich, Function, If, and Variable action settings on the policy workflow.

You can use APIs to manage global variables and event enrichment policies to fetch the variable values. For more information, see Managing global variables with REST APIs,

From the GUI, you can update global variables but not create them. For updating global variables from the GUI, see Actions for advanced and time-based enrichment.

Global variables are addressed by name, so you must know the name of the global variable to use it. Global variable names do not contain a space and are prefixed with $GV. A global variable consists of attributes that can have String, List of String, Integer, and List of Integer data types. Multiple attributes inside a global variable can have different data types. You cannot nest global variables. Use the following syntax to refer to an attribute listed in a global variable:

$GV.<VariableName>.<AttributeName>

Examples for global variables

Refer the following global variable examples:

Example 1

$GV.entity_details.entity_name=hostA.<company_name>.com
$GV.entity_details.entity_location=Houston
$GV.entity_details.entity_status=Up

Here, entity_name, entity_location, and entity_status are attributes of the $GV.entity_details global variable.

Example 2

$GV.nagios_contact.contact_name=John Doe
$GV.nagios_contact.alias=jdoe
$GV.nagios_contact.email=jdoe@nagios.com
$GV.nagios_contact.pager=555-5555@pagergateway.<company_name>.domain

Example 3 (Global variables used in the external source file for dynamic enrichment policies) 

Global-Variable-Host-Owner-Mapping.csv

The following column mappings are in this file:

Column 1 corresponds to the Hostname match slot
Column 2 corresponds to the Message match slot
Column 3 corresponds to the Owner enrichment slot