Velocity Template Usage Tips

• Use with strings and numeric values only.

  Velocity templates apply only to fields that contain string or numeric values.

• Use with dynamic parameters and ArcSight variables.

  You can use all of the dynamic time parameters you see in the Active Channel Editor and elsewhere, such as $Now and $CurrentDateTime. The same is true for time elements, including s (second), m (minute), d (date), M (month), w (week), and y (year). To use any event data field as a variable, express its displayed name as a one-word, camel case string prefixed with a dollar sign. For example, "Source Address" would be $sourceAddress. For details about using variables in a velocity expression, see Using Variables in a Velocity Expression.

• Regular expressions are not supported.

  Use of regular expressions is not tested or supported.

• Test using active channel custom field.

  You can conveniently test Velocity templates by trying them first in a customField of an active channel.