Use GlobalEventID in a Query
To help you identify an event that might be seen by multiple ArcSight components, the connectors assign the event a unique 64-bit ID. To include a GEID in your search query, enter globalEventID. You can view the GEID of the event in the Event Details.
| Syntax | Example |
|---|---|
| global event id=<value> | global event id= 2864991913017849867 |
For events to have a GEID, use ArcSight Management Center to configure connectors to include the ID. For more information in:
-
Non-SaaS environments, see "Generator ID Manager" in the Administrator's Guide for the ArcSight Platform
-
SmartConnectors, see "Unique Generator ID" in the ArcSight SmartConnector Installation Guide.