Use GlobalEventID in a Query

To help you identify an event that might be seen by multiple ArcSight components, the connectors assign the event a unique 64-bit ID. To include a GEID in your search query, enter globalEventID. You can view the GEID of the event in the Event Details.

Syntax	Example
<geid> <value>	global event id= 2864991913017849867

For events to have a GEID, use ArcSight Management Center to configure connectors to include the ID. For more information, see the Administrator’s Guide to ArcSight Platform or the guide for the connector.