Variables are custom fields defined by the rule author on the Condition tab. Each variable consists of a unique name and an expression.



The user-defined variables can be referenced in the rule condition.

Response Actions

Similar to the built-in window fields, variables can be included by name in the notifications messages, scripts, and logging messages using placeholders:



Variables cannot be included in a filter expression because filters are evaluated prior to the command being added to a window.

Data Types


pival = 3.14


kb = 1024


curtime = 1515758392702

Classify large integers as Long (64-bit integer) or floating numbers to avoid 32-bit integer overflow. The range of values that a regular 32-bit integer can hold is [-2147483647, 2147483648].


Use single or double quotes when declaring a string variable.

state = 'CA'

Inner quotes can be escaped with backslash.

sqlQuery = 'SELECT value AS used_mb FROM "" WHERE entity = \'' + entity + '\''
sqlQuery = "SELECT value AS used_mb FROM \"\" WHERE entity = '" + entity + "'"


errorCodes = [401, 403, 404]

A collection can include elements of different types.

Both single and double quotes can be used to specify elements of string type.

stateList = ['CA', 'WA']
stateList = ["CA", "WA"]

To check the size of the collection, use the .size() method.

To access the n-th element in the collection, use square brackets [index] or the get(index) method (starting with 0 for the first element).

authors = split(tags.authors, ',')
  authors.size() == 0 ? 'n/a' : authors[0]


stateMap = ['CA': 0.8, 'WA': 0.2]
stateMap = ["CA": 0.8, "WA": 0.2]

Both single and double quotes can be used to specify map keys and values.


last_msg = db_message_last('1 week', 'alert', 'rule-engine')
since_start = formatIntervalShort(elapsedTime(property('dkr.state::started')))
server = upper(keepBefore(entity, ':'))


annotation = tags.note == null ? 'N/A' : tags.note


The variables can refer to other variables declared in the same rule.

Variables can be included in a condition.


Variables are evaluated for each incoming command regardless of the window status.

If the variable invokes an external function such as scriptOut it must execute quickly (less than a few seconds). Avoid invoking long-running functions in variables.

The current value of a variable can be accessed on the Window Details page.