Adding a Unique ID to Migrated Events

To help you identify an imported event that might be seen by multiple ArcSight components, SmartConnectors can assign a unique 64-bit ID to each event. You can use this globalEventID (GEID) in search queries and view the GEID in an event’s details. This feature is enabled by default in Logger. However, in the case that imported events do not already have a GEID, use the Archive Migration Tool to generate IDs.

For more information about using Logger to generate the ID, see the Administrator's Guide to ArcSight Logger.

1. Perform Steps 1–3 of the Running the Archive Migration Tool procedure.

2. Select Generator ID in the initial menu:

   What do you want to do?
   [ ] Manage S3 Bucket
   [ ] Archives Available
   [ ] Logger Information
   [ x ] Generator ID
   [ ] Generate Catalog
   [ ] Exit

3. Depending on whether the Generator ID has already been assigned a value, the next menu will show one of the next two possible options:

   • If the Generator ID has no value assigned, the Archive Migration Tool will ask for a value to be set for it:

     Enter the Generator ID: your_value

     where your_value must be a number between 1 and 16383 to be accepted.

   • If the Generator ID was previously configured in Logger, the default selection (Receiver Process) will be displayed:

     Generator ID [14]
     Do you want to modify the Generator ID?
     [ x ] Yes
     [ ] No

     Select Yes to bring up a menu that allows you to change the Generator ID to a specific set value or your own choice:

     Select the Generator ID
     [ ] Aps [ 13 ]
     [ ] Servers [ 12 ]
     [ x ] Receivers [ 14 ]
     [ ] Other Generator ID
     [ ] Back