Event Orchestration Cache Variables allow you to store event information once events are converted into alerts or incidents. You can then use this stored information in Event Orchestration rules for setting conditions or triggering actions. Using cache variables in this way helps manage scenarios where understanding a system's status, event patterns, or timing is critical for diagnosing issues.

There are two ways to store data in variables. Both variable types populate whenever an event matches the conditions assigned to a cache variable:

• Recent event values: Assign data from an event to a cache variable.
• Count of events: Number of occurrences of events matching the cache variable’s condition.

📘

Cache Variables vs. Rule Variables

Unlike Rule Variables, which are limited to use within a single rule, cache variables can be applied throughout the entire orchestration. For more information on Rule Variables, please refer to our Event Orchestration article.

👍

Tip

Configuring cache variable conditions is an identical process to setting Event Orchestration rule conditions.

Configure Event Orchestration Cache Variables

📘

Cache Variable Usage Limited to Orchestration of Origin

Cache variables can be set in both Global and Service Orchestrations, but they are only usable within the orchestration in which they were created.

Step 1: View Cache Variables

You can access Event Orchestration cache variables from either the Global Event Orchestration or Service Event Orchestration builders.

To view cache variables:

1. In the web app, navigate to AIOps Event Orchestration select an Orchestration then select your desired Global Orchestration or Service Orchestration.
2. Click View Cache Variables in the bottom left. This will expand the Cache Variables pane.
3. Any existing cache variables will display in this view. If no cache variables exist yet, you will be able to review some information about creating your first cache variable.

Step 2: Create a New Cache Variable

To create a new cache variable:

1. Click + Variable to open the cache variable creator modal.
2. Define the conditions that will determine when a cache variable populates with data:
   1. Variable Type: Select a variable type from the dropdown. This defines what data populates into a cache variable. There are four options for cache variable type, and you can only select one at a time for each cache variable. Choose one of the following options and fill in the required fields:
      1. Event Data (CEF): Stores CEF data associated with an event in the cache variable. Note: If Event Orchestration has altered an event’s data prior to cache variable population, the altered data will be stored in the cache variable.
      2. Raw Data: Allows you to target information in an event’s raw payload for storage.
      3. Event Count: Tracks the number of times an event matching the specified cache variable conditions has occurred.
      4. External Data (API / Manual input): Allows you to leverage data from external sources to add additional context to orchestration rules.
         • Choose a Data Format to set what type of data (Text String, Number, or Boolean) can be stored in the variable. Please view the table in the Product Limits section for limit information.
         • Enter your desired Data Retention timeframe (in seconds) to set the Time To Live (TTL) for how long the data will be stored for. The TTL timer resets upon each cache variable value update. The configured TTL sets when the data loads and cannot be retroactively changed for existing data. If you update the TTL, it will apply after the next cache variable value update.
3. Variable Name: Enter a variable name. This is the display name that will appear in Event Orchestration rules and actions.
4. You may optionally add further conditions by clicking + New Condition. Note: Creating conditions for cache variables follows the same process as creating routing rules for Event Orchestration.
5. When you are finished, click Save.

Step 3: Use Your Cache Variable

You can use cache variables in either Event Orchestration rule conditions or actions.

📘

Cache Variable Duration

Stored values last for 24 hours, or until they're replaced by a new value. When a new value is set, the 24-hour countdown starts again.

Use a Cache Variable in a Condition

1. Click + New Rule, + Else Rule or Nest Rule to add a new rule, or click to edit an existing rule in an Event Orchestration that contains cache variables.
2. Select If events match certain conditions from the condition type dropdown.
3. Assign the cache variable to either the target (e.g., event.summary) or value (i.e., the value being compared to whatever data is stored in the target) portion of the condition:
   1. To assign a cache variable to the target portion of an Event Orchestration condition, click the left cell that shows event and select Cache Variable from the dropdown. This will populate the cell with cache_var., which is how Event Orchestration references cache variables. Then type the cache variable name you wish to use after the period in the same cell (e.g., cache_var.server_status). Once complete, enter your preferred value in the right cell.
   2. To assign a cache variable to the value portion of an Event Orchestration condition, select your preferred target from the right cell and then click into the blank right cell in the condition builder. Type the name of the cache variable you want to reference using the following syntax: cache_var.your_variable_name.

📘

Tip

Using a cache variable in the target portion of a condition means a rule will evaluate true or false without referencing the data in an event when an event is ingested. This allows you to create a logic gate that activates different branches of an Event Orchestration depending on what data is in a cache variable (e.g., maintenance_window, server_status, deployment_status, etc.).

Use a Cache Variable in an Action

1. Navigate to the action you wish to reference the cache variable in. Supported actions are:
   1. Add incident note
   2. Replace event fields
   3. Custom Fields
   4. Webhooks
2. Add the cache variable to the action using the following syntax: {{cache_var.your_variable_name}}.
3. Click Save.

Edit Event Orchestration Cache Variables

1. In the web app, navigate to AIOps Event Orchestration select an Orchestration and then select your desired Global Orchestration or Service Orchestration.
2. Click View Cache Variables in the bottom left to expand the Cache Variables pane.
3. To the right of your desired cache variable, select Edit configuration.
4. Make your desired changes to the cache variable's condition(s) and properties and click Save.

Disable or Delete Event Orchestration Cache Variables

❗️

Disabled and Deleted Cache Variables

Please be advised that disabling or deleting a cache variable may lead to unexpected behavior if there are any rules that still reference it. When you disable or delete a cache variable, it evaluates as NULL. For example, say you create a cache variable host and use it in a rule: cache_var.host matches event.host. After disabling or deleting host, the rule would evaluate to NULL matches event.host.

As a best practice, please update your Event Orchestration rules before disabling or deleting a cache variable.

Disable an Event Orchestration Cache Variable

1. In the web app, navigate to AIOps Event Orchestration select an Orchestration and then select your desired Global Orchestration or Service Orchestration.
2. Click View Cache Variables in the bottom-left to expand the Cache Variables pane.
3. To the right of your desired cache variable, select Disable.
4. In the confirmation modal, click Disable.

To re-enable a cache variable, select Enable.

Delete an Event Orchestration Cache Variable

❗️

Deletion is Permanent

This action cannot be undone, and deleted cache variables cannot be recovered.

1. In the web app, navigate to AIOps Event Orchestration select an Orchestration and then select your desired Global Orchestration or Service Orchestration.
2. Click View Cache Variables in the bottom-left to expand the Cache Variables pane.
3. To the right of your desired cache variable, select Delete.
4. In the confirmation modal, click Delete.

Product Limits

Cache Variables per Orchestration

• Each Global Orchestration can have 100 cache variables.
• Each Service Event Orchestration can have 100 cache variables.
• We do not support Cache variables for Service Routes.

Cache Variable Content

Cache Variable Accuracy

Cache variables will process in order in a best-effort manner. Although it is expected that updates to the variables will be handled in FIFO order, this cannot be guaranteed when multiple updates occur in less than 1 second.

FAQ

Can you use a cache variable created in a Global Orchestration as part of a Service Orchestration?

Can you view historical values for a cache variable?

What happens if a cache variable value exceeds 1024 characters?

Can non-string types be converted to strings?

What is the maximum value an Event Count variable can be?

What happens if two cache variables in the same Event Orchestration have the same name?

How can I tell what the current value of a cache variable is?

Is the Event Orchestration Cache Variables API supported?