Reference: Variables

You can use variables when you create a connection. For some connection destinations and formats, you can use variables for configured fields that can be replaced with new values when the connection run starts.

Connection variables

Variable AWS S3 Elasticsearch Email (O365, SMTP) File SMB Formats
S3 Bucket Name and Optional Path File Name URL Subject Attachment File Name File Name File Name Share Name Directory Name Syslog: MessageId CEF: Source LEEF: Source

{connection id}
{connectionid}

Numeric ID of the connection; unique only to a specific Module Server











{connection name}
{connectionname}

User-configured name of the connection











{connection run id}
{connectionrunid}

Numeric ID of the connection run; unique only to a specific Module Server











{source}1

Human-readable name of the connection source











{computer group}2
{computergroup}2

Name of the computer group from the Tanium Server











{file extension}
{fileextension}

File extension of the chosen format











1 The {source} variable is interpreted as the data source name (for example, Client Status) for most data sources. For saved questions, the {source} variable is interpreted as the saved question name.

2 The {computer group} and {computergroup} variables are available for only the saved question data source. No other data sources offer computer group filtering.
Variable AWS S3 Elasticsearch Email (O365, SMTP) Formats
S3 Bucket Name and Optional Path File Name URL Subject Attachment File Name Syslog: MessageId CEF: Source LEEF: Source

{connection id}
{connectionid}

Numeric ID of the connection; unique only to a specific Module Server







{connection name}
{connectionname}

User-configured name of the connection







{connection run id}
{connectionrunid}

Numeric ID of the connection run; unique only to a specific Module Server







{source}1

Human-readable name of the connection source







{computer group}2
{computergroup}2

Name of the computer group from the Tanium Server







{file extension}
{fileextension}

File extension of the chosen format







1 The {source} variable is interpreted as the data source name (for example, Client Status) for most data sources. For saved questions, the {source} variable is interpreted as the saved question name.

2 The {computer group} and {computergroup} variables are available for only the saved question data source. No other data sources offer computer group filtering.

Time stamp variables

Use time stamp variables with the File Name Time Stamp Format, File Name, AWS S3 S3 Bucket Name and Optional Path, and Elasticsearch URL fields to customize the time stamp that Connect appends.

  • For the File Name, Elasticsearch URL, and AWS S3 S3 Bucket Name and Optional Path fields, enclose the variables in curly bracket characters: { and }.
  • For File Name Time Stamp Format fields, do not use curly bracket characters with variables.

Any characters in the format string that are not in the following table are passed through to the destination.

Time stamp variables for File Name, URL, and S3 Bucket Name and Optional Path fields
Variable Description
{MM-DD-YYYY}
{%m/%d/%y}1 		United States
{YYYY-MM-DD}
{%Y-%m-%d}1 		ISO 8601
{%v} VMS
{%C} Century
{%y} Year without Century
{%Y} Year with Century
{%m} Month from 01 to 12
{%b} Month abbreviation
{%B} Month
{%W} Week assuming Monday first
{%U} Week assuming Sunday first
{%a} Weekday abbreviation
{%A} Weekday
{%d} Day from 01 to 31
{%e} Day from 1 to 31
{%w} Day from 0 to 6
{%j} Day from 001 to 366
{%u} Day from 1 to 7
{%H} Hour from 00 to 23
{%I} Hour from 01 to 12
{%k} Hour from 0 to 23
{%l} Hour from 0 to 12
{%M} Minute
{%S} Second
{%s} Seconds since 1970
{%L} Millisecond from 000 to 999
{%s%L} Milliseconds since 1970
{%p} AM/PM
{%P} am/pm
{%r}
{%l:%M:%S %p} 		12-hour time (seconds)2
{%R}
{%H:%M} 		24-hour time (minutes)2
{%T}
{%H:%M:%S} 		24-hour time (seconds)2
{%z} Time zone hour offset
{%Z} Time zone name

1 Not available for Elasticsearch URL.
2 Not available for File or SMB destination File Name.

 

Time stamp variables for File Name Time Stamp Format fields
Variable Description
MM-DD-YYYY
%m/%d/%y 		United States
YYYY-MM-DDTHH-mm-ss
%Y-%m-%d 		ISO 8601
%v VMS
%C Century
%v Year without Century
%Y Year with Century
%m Month from 01 to 12
%b Month abbreviation
%B Month
%W Week assuming Monday first
%U Week assuming Sunday first
%a Weekday abbreviation
%A Weekday
%d Day from 01 to 31
%e Day from 1 to 31
%w Day from 0 to 6
%j Day from 001 to 366
%u Day from 1 to 7
%H Hour from 00 to 23
%I Hour from 01 to 12
%k Hour from 0 to 23
%l Hour from 0 to 12
%M Minute
%S Second
%s Seconds since 1970
%L Millisecond from 000 to 999
%s%L Milliseconds since 1970
%p AM/PM
%P am/pm
%r
%l:%M:%S %p 		12-hour time (seconds)1
%R
%H:%M 		24-hour time (minutes)1
%T
%H:%M:%S 		24-hour time (seconds)1
%z Time zone hour offset
%Z Time zone name
1 Not available for File or SMB destination File Name.