Reference: Variables

You can use variables when you create a connection. For some connection destinations and formats, you can use variables for configured fields that can be replaced with new values when the connection run starts.

Connection variables

Table 1:   Connection variables
Variable AWS S3 Elasticsearch Email File Formats
S3 Bucket Name and Optional Path File Name URL Subject Attachment File Name File Name Syslog: MessageId CEF: Source LEEF: Source

{connection id}

Numeric ID of the connection; unique only to a specific Module Server

{connection name}

User-configured name of the connection

{connection run id}

Numeric ID of the connection run; unique only to a specific Module Server


Human-readable name of the connection source

{computer group}2

Name of the computer group from the Tanium Server

{file extension}

File extension of the chosen format

1 The {source} variable is interpreted as the data source name (for example, System Status) for most data sources. For saved questions, the {source} variable is interpreted as the saved question name.

2 The {computer group} and {computergroup} variables are available for only the saved question data source. No other data sources offer computer group filtering.

Time stamp variables

For connection sources and destinations that produce columns with the DateTime value type, Connect provides two default date/time formats: MM/DD/YYYY or YYYY-MM-DDTHH:mm:ssZ. You can update the format using time stamp variables. You can also create a Timestamp custom column type using variables for the Date/Time Format field.

For connection destination file names, the two default formats are MM-DD-YYYY or YYYY-MM-DDTHH-mm-ss.

Any characters in the format string that are not in the following table are passed through to the destination. Unless otherwise noted, these variables can also be used for AWS S3 destination bucket names or file names and Elasticsearch destination URLs.

Table 2:   Time stamp variables
Variable Description
United States
ISO 8601
{%v} VMS
{%C} Century
{%y} Year without Century
{%Y} Year with Century
{%m} Month from 01 to 12
{%b} Month abbreviation
{%B} Month
{%W} Week assuming Monday first
{%U} Week assuming Sunday first
{%a} Weekday abbreviation
{%A} Weekday
{%d} Day from 01 to 31
{%e} Day from 1 to 31
{%w} Day from 0 to 6
{%j} Day from 001 to 366
{%u} Day from 1 to 7
{%H} Hour from 00 to 23
{%I} Hour from 01 to 12
{%k} Hour from 0 to 23
{%l} Hour from 0 to 12
{%M} Minute
{%S} Second
{%s} Seconds since 1970
{%L} Millisecond from 000 to 999
{%s%L} Milliseconds since 1970
{%p} AM/PM
{%P} am/pm
{%l:%M:%S %p}
12-hour time (seconds)
24-hour time (minutes)
24-hour time (seconds)
{%z} Time zone hour offset
{%Z} Time zone name

1 Default options for columns.

2 Default options for file names. Not available for AWS S3 destination bucket names or file names.

3 Not available for Elasticsearch destination URLs.