> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/get-started-with-xql/understanding-string-manipulation-in-xql.md).

# Understanding string manipulation in XQL

Use string manipulation in XQL queries in Cortex AgentiX.

When defining string fields in Cortex Query Language (XQL) queries, it's important to understand the various string manipulations available and the syntax required to build effective queries that return the results you're expecting. Cortex Query Language (XQL) uses [RE2](https://github.com/google/re2/wiki/Syntax) for its regular expression implementation.

Cortex AgentiX enables you to use single double quotes (`"<text>"`) or triple double quotes (`"""<text>"""`) when defining your XQL syntax for string manipulation. This specific syntax is used with different stages, functions, and operators, with or without wildcards. Typically, the `alter` and `filter` stages are used with single or triple double quotes, so these stages are used in the examples provided below.

<details>

<summary>Using single double quotes</summary>

Single double quotes (`"<text>"`) include the following functionality:

* Treats the string value literally.
* Wildcards using the asterisk (\*) return every sequence of characters that contains the specified sequence of characters.
* Escape sequences, such as `\n` (new line) or `\t` (tab), are not processed and are treated as plain characters.

Example: `"*test"` returns `test, atest, testb, abtestcd`, etc.

</details>

<details>

<summary>Using triple double quotes</summary>

Triple double quotes (`"""<text>"""`) include the following functionality:

* Enables regex-style pattern matching and escape sequence interpretation.
* Escape sequences, such as `\n` (new line) or `\t` (tab), are processed.
* Wildcards using the asterisk (\*) are processed as XQL wildcards, and match any sequence of characters.

Example : `"""*test"""` returns `atest, 123test` , etc.

</details>

<details>

<summary>Query example using alter</summary>

When using the `alter` stage, you can use both single (`"<text>"`) and triple (`"""<text>"""`) double quotes when specifying string values. The difference lies in how special characters and pattern matching are interpreted.

Example

```programlisting
config timeframe = 10y 
| dataset = test_dataset  
| limit 1
| alter test = "\test\"
| alter test_triple = """\\\test\\"""
| fields test, test_triple
```

**Understanding the query and results**

* `test` field using single double quotes:
  * The field value is `"\test\"`.
  * The output results display `\test\` exactly as defined in the field value as no escape sequences are processed.
* `test_triple` field using triple double quotes:
  * The field value is `"""\\\test\\"""`.
  * The output results display `\ est\` (with a tab between `\` and the text `est`) because:
    * `\\`: First two backslashes become single backslash `\`.
    * `\t`: Interpreted as a tab.
    * `est`: Is interpreted as literal.
    * `\\`: Last two backslashes become single backslash `\`.

</details>

<details>

<summary>Query example using filter</summary>

When using the `filter` stage, you can use both single (`"<text>"`) and triple (`"""<text>"""`) double quotes when specifying string values. The difference lies in how special characters and pattern matching are interpreted.

The examples provided are based on the following data table for a dataset called `test_dataset`:

| \_TIME                 | TEST      |
| ---------------------- | --------- |
| Mar 26th 2022 19:26:07 | 12\t3     |
| May 7th 2023 15:16:00  | 12 3      |
| Jun 8th 2024 16:56:27  | 1233      |
| Mar 26th 2024 19:26:07 | 123       |
| Apr 5th 2024 11:21:02  | 12\t34563 |
| Apr 9th 2025 13:22:22  | 1233345   |
| May 9th 2025 13:22:22  | 12 35897  |
| May 30th 2025 21:45:02 | 116       |

Example 86.

```programlisting
config timeframe = 10y 
| dataset = test_dataset  
| filter test = "12\t3*"
| fields test
```

**Output results table**:

| \_TIME                 | TEST      |
| ---------------------- | --------- |
| Mar 26th 2022 19:26:07 | 12\t3     |
| Apr 5th 2024 11:21:02  | 12\t34563 |

**Explanation of results**:

The asterisk (`*`) in `"12\t3*"` means to process the string field as an XQL wildcard by matching any sequence of characters that begins with `12\t3`. In addition, the `\t` characters are not processed as an escape character, but as plain characters.

Example 87.

```programlisting
config timeframe = 10y 
| dataset = test_dataset  
| filter test = """12\t3*"""
| fields test
```

**Output results table**:

| \_TIME                | TEST     |
| --------------------- | -------- |
| May 7th 2023 15:16:00 | 12 3     |
| May 9th 2025 13:22:22 | 12 35897 |

**Explanation of results**:

The `\t` in `"""12\t3*"""` is processed as a tab escape character. The asterisk (`*`) in `"""12\t3*"""` means to process the string field as an XQL wildcard by matching any sequence of characters that begins with `12<tab>3`.

</details>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/get-started-with-xql/understanding-string-manipulation-in-xql.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.