> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/ltrim-rtrim-trim.md).

# ltrim, rtrim, trim

**Syntax**

```programlisting
trim (<string>,[trim_characters])
```

```programlisting
rtrim (<string>,[trim_characters])
```

```programlisting
ltrim (<string>,[trim_characters])
```

**Description**

* The `trim()` function removes all instances of the specified `trim_characters` defined in the second parameter of the function from the beginning and end of the string defined in the first parameter of the function.
* The `rtrim()` function removes all instances of the specified `trim_characters` defined in the second parameter of the function from the end of the string defined in the first parameter of the function.
* The `ltrim()` function removes all instances of the specified `trim_characters` defined in the second parameter of the function from the beginning of the string defined in the first parameter of the function.

Keep in mind the following important points before using these functions, where relevant examples are provided:

* The specified `trim_characters` do not need to be in any order.

  Example 123.&#x20;

  Either of these yield the same result:

  ```programlisting
  rtrim("explorer.exe", ".ex")
  ```

  ```programlisting
  rtrim("explorer.exe", ".exe")
  ```

  ```programlisting
  rtrim("explorer.exe", "x.e")
  ```

  Output result:

  ```programlisting
  "explorer"
  ```
* trim\_characters don't support regular expressions or escape characters.

  Example 124.&#x20;

  ```programlisting
  ltrim("***a*aapple*", "*a")
  ```

  Output results:

  ```programlisting
  "pple*"
  ```
* All occurrences of the `trim_characters` supplied are removed from left to right until it reaches a letter that is not part of the supplied letters.

  Example 125.&#x20;

  ```programlisting
  ltrim("hello world", "leh")
  ```

  Output results:

  ```programlisting
  "o world"
  ```
* A space in the string can also be considered a character.
* The `ltrim()`, `rtrim()`, and `trim()` functions are case sensitive unless there is an override.

  Example 126.&#x20;

  ```programlisting
  ltrim("***a*aapple*", "*A")
  ```

  Output results:

  ```programlisting
  "a*aapple*"
  ```
* If you do not specify `trim_characters`, then whitespace (spaces and tabs) are removed.

  Example 127.&#x20;

  ```programlisting
  ltrim("  apple*")
  ```

  Output results:

  ```programlisting
  "apple*"
  ```

**Examples**

A complete query example, where the output results of each `ltrim()`, `rtrim()`, and `trim()` function is detailed in the comments.

```programlisting
config timeframe = 1w | dataset = xdr_data
| limit 1
| alter
    example_1 = rtrim("explorer.exe", "x.e"), // ---> "explorer"
    example_2 = ltrim("hello world", "leh"), // ---> "o world"
    example_3 = trim("  apple*  ", " "), // ---> "apple*"
    example_4 = ltrim("***a*aapple*", "*A") // ---> "a*aapple*"
| fields example*
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/ltrim-rtrim-trim.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.