Use with strings and numeric values only.
Velocity templates apply only to fields that contain string or numeric values.
Use with dynamic parameters and ArcSight variables.
You can use all of the dynamic time parameters you see in the Active Channel Editor and elsewhere, such as $Now and $CurrentDateTime. The same is true for time elements, including s (second), m (minute), d (date), M (month), w (week), and y (year). To use any event data field as a variable, express its displayed name as a one-word, camel case string prefixed with a dollar sign. For example, "Source Address" would be $sourceAddress. For details about using variables in a velocity expression, see Using Variables in a Velocity Expression.
Regular expressions are not supported.
Use of regular expressions is not tested or supported.
Test using active channel custom field.
You can conveniently test Velocity templates by trying them first in a customField of an active channel.