The Event Orchestration Cache Variable feature lets you save event information once events become alerts or incidents. You can use this saved information in Event Orchestration rules for conditions or actions. You can set cache variables in both Global and Service Orchestrations; however, you cannot use them outside of the orchestration where they were created. Using cache variables in Event Orchestration rules can facilitate handling various new situations where understanding a system's status, event patterns, or timing is crucial for identifying the issue at hand. You can use cache variables throughout an Orchestration, and this differs from Rule Variables which you can only leverage within a specific rule. For more information on Rule Variables, please refer to our Event Orchestration article.

There are two ways to store data in variables. Both variable types are populated whenever an event matches the conditions assigned to a cache variable:

• Recent event values: Assign data from an event to a cache variable.
• Count of events: Number of occurrences of events matching the cache variable’s condition.

📘

Tip

Configuring cache variable conditions works identically to setting Event Orchestration rule conditions.

Configure Event Orchestration Cache Variables

Step 1: View Cache Variables

You can access Event Orchestration cache variables from either the Global Event Orchestration or Service Event Orchestration builder.

To view cache variables:

1. In the web app, navigate to AIOps Event Orchestration and select your desired Global Orchestration or Service Orchestration.
2. Click View Cache Variables in the bottom-left. This will expand the Cache Variables pane.
3. Any existing cache variables will display in this view. If no cache variables exist yet, you will be able to review some information about creating your first cache variable.

Step 2: Create a New Cache Variable

To create a new cache variable:

1. Click + Variable to open the cache variable creator modal.
2. Define the conditions that will determine when a cache variable populates with data, and click Next.
   1. Note: Creating conditions for cache variables follows that same process as creating rules for Event Orchestration.
3. Enter a Variable Name and select a Variable Type from the dropdown: Event Data (CEF), Raw Data, or Event Count.
   1. The Variable Name is the display name that will appear in Event Orchestration rules and actions.
   2. The Variable Type defines what data populates into a cache variable. There are three options for cache variable type and only one can be selected at a time for each cache variable. The three options are:
      1. Event Data (CEF): Stores CEF data associated with an event in the cache variable. Note: If Event Orchestration has altered an event’s data prior to cache variable population, the altered data will be stored in the cache variable.
      2. Raw Data: Allows you to target information in an event’s raw payload for storage.
      3. Event Count: Tracks the number of times an event matching the specified cache variable conditions has occurred.
4. When you are finished, click Save.

Step 3: Using Your Cache Variable

You can use cache variables in either Event Orchestration rule conditions or actions.

📘

Cache Variable Duration

Stored values last for 24 hours or until they're replaced by a new value. When a new value is set, the 24-hour countdown starts again.

Use a Cache Variable in a Condition

1. Click + New Rule or click to edit an existing rule in an Event Orchestration that contains cache variables.
2. Select If events match certain conditions from the condition type dropdown.
3. Assign the cache variable to either the target (e.g., event.summary) or value (i.e., the value being compared to whatever data is stored in the target) portion of the condition.
   1. To assign a cache variable to the target portion of an Event Orchestration condition, click the cell that shows event and scroll to the bottom of the resulting dropdown. Next, select Cache Variable. This will populate the cell with cache_var, which is how Event Orchestration references cache variables. Then type the cache variable name you wish to use after the period in the cell (e.g., cache_var.server_status).
   2. To assign a cache variable to the value portion of an Event Orchestration condition, click the cell that is blank in the condition builder. Type the name of the cache variable you want to reference using the following syntax: cache_var.your_variable_name.

📘

Tip

Using a cache variable in the target portion of a condition means a rule will evaluate true or false without referencing the data in an event when an event is ingested. This allows you to create a logic gate that activates different branches of an Event Orchestration depending on what data is in a cache variable (e.g., maintenance_window, server_status, deployment_status, etc.).

Use a Cache Variable in an Action

1. Navigate to the action you wish to reference the cache variable in. Supported actions are:
   1. Add incident note
   2. Replace event fields
   3. Webhooks
2. Add the cache variable to the action using the following syntax: {{cache_var.your_variable_name}}.
3. Click Save.

Edit Event Orchestration Cache Variables

1. In the web app, navigate to AIOps Event Orchestration and select your desired Global Orchestration or Service Orchestration.
2. Click View Cache Variables in the bottom left to expand the Cache Variables pane.
3. To the right of your desired cache variable, select Edit configuration.
4. Make your desired changes to the cache variable's condition and click Next.
5. Make your desired changes to the cache variable's properties and click Save.

Disable or Delete Event Orchestration Cache Variables

❗️

Disabled and Deleted Cache Variables

Please be advised that disabling or deleting a cache variable may lead to unexpected behavior if there are any rules that still reference it. When you disable or delete a cache variable, it evaluates as NULL. For example, say you create a cache variable host and use it in a rule cache_var.host matches event.host. After disabling or deleting host, the rule would evaluate to NULL matches event.host.

As a best practice, please update your Event Orchestration rules before disabling or deleting a cache variable.

Disable an Event Orchestration Cache Variable

1. In the web app, navigate to AIOps Event Orchestration and select your desired Global Orchestration or Service Orchestration.
2. Click View Cache Variables in the bottom-left to expand the Cache Variables pane.
3. To the right of your desired cache variable, select Disable.
4. In the confirmation modal, click Disable.

To re-enable a cache variable, select Enable.

Delete an Event Orchestration Cache Variable

1. In the web app, navigate to AIOps Event Orchestration and select your desired Global Orchestration or Service Orchestration.
2. Click View Cache Variables in the bottom-left to expand the Cache Variables pane.
3. To the right of your desired cache variable, select Delete.
4. In the confirmation modal, click Delete.

Note: This action cannot be undone, and deleted cache variables cannot be recovered.

Product Limits

Cache Variables per Orchestration

• Each Global Orchestration can have 100 cache variables.
• Each Service Event Orchestration can have 100 cache variables.
• Cache variables are not supported for Service Routes.

Cache Variable Content

Cache Variable Accuracy

Cache variables will be processed in order in a best effort manner. Although it is expected that updates to the variables will be handled in FIFO order, this cannot be guaranteed when multiple updates occur in less than 1 second.

FAQ

Can you use a cache variable created in a Global Orchestration as part of a Service Orchestration?

Can you view historical values for a cache variable?

What happens if a cache variable value exceeds 1024 characters?

Can non-string types be converted to strings?

What is the maximum value an Event Count variable can be?

What happens if two cache variables in the same Event Orchestration have the same name?

How can I tell what the current value of a cache variable is?

Is the Event Orchestration Cache Variables API supported?