Use GlobalEventID in a Query

To help you identify an event that might be seen by multiple ArcSight components, the connectors assign the event a unique 64-bit ID. To include a GEID in your search query, enter globalEventID. You can view the GEID of the event in the Event Details.

Syntax	Example
global event id=<value>	global event id= 2864991913017849867

For events to have a GEID, use ArcSight Management Center to configure connectors to include the ID. For more information in:

• Non-SaaS environments, see "Generator ID Manager" in the guide corresponding to your deployment:

  • Administrator's Guide for the ArcSight Platform 24.2 - AWS Deployment

  • Administrator's Guide for the ArcSight Platform 24.2 - Azure Deployment

  • Administrator's Guide for the ArcSight Platform 24.2 - Google Cloud Deployment

  • Administrator's Guide for the ArcSight Platform 24.2 - Off-cloud Deployment

• SaaS environments, see " Setting Up Generator ID Management" in the Quick Start for Administrators.

• SmartConnectors, see "Unique Generator ID" in the ArcSight SmartConnector Installation Guide.