Replacing $Now with a global variable

File uploaded by awmorris on Jul 14, 2014
Version 1Show Document
  • View in full screen mode

When manipulating variables inside of queries and rules, ArcSight limits acceptable choices to standard fields or global variables. This makes the $Now variable inaccessible in some situations where we need it.  We discovered an ArcSight event that fires every minute.  Using this event as a trigger, we can populate an active list and then read this value in a global variable.  This allows us to effectively replicate the use of $Now in global variables.