> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/data-management/parsing-rules/parsing-rules-file-structure-and-syntax/const.md).

# CONST

{% hint style="info" %}

### License

Requires a Data Collection add-on.
{% endhint %}

{% hint style="warning" %}

### Prerequisite

Parsing Rules requires **View/Edit** RBAC permissions for **Data Management** (under **Configurations** → **Data Management**), which are the same permissions required for Dataset Management, Data Model Rules, and Event Forwarding.
{% endhint %}

A `CONST` section is used to define strings and numbers that can be reused multiple times within Cortex Query Language (XQL) statements in other `INGEST` sections by using `$constName`. This can be helpful to avoid writing the same value in multiple sections, similar to constants in modern programming languages.

Example

```programlisting
[CONST]
DEFAULT_DEVICE_NAME = "firewall3060";       // string
FILE_REGEX = "c:\\users\\[a-zA-Z0-9.]*";    // complex string
my_num = 3;                                 /* int */
```

An example of using a `CONST` inside XQL statements in other `INGEST` sections using `$constName`:

{% hint style="info" %}

### Note

The dollar sign (`$`) must be adjacent to the `[CONST]` name, without any whitespace in between.
{% endhint %}

```programlisting
...
| filter device_name = $DEFAULT_DEVICE_NAME
| alter new_field = JSON_EXTRACT(field, $FILE_REGEX)
| filter age < $MAX_TIMEOUT
| join type=$DEFAULT_JOIN_TYPE conflict_strategy=$DEFAULT_JOIN_CONFLICT_STRATEGY (dataset=my_lookup) as inn url=inn.url
...
```

{% hint style="info" %}

### Important

Only quoted or integer terminal values are considered valid for `CONST` sections.
{% endhint %}

Example

These will not compile:

```programlisting
[CONST]
WORD_CONST = abcde;                             //invalid
func_val = regex_extract(_raw_log, "regex");    // not possible
RECURSIVE_CONST = $WORD_CONST;                  // not terminal - not possible
```

`CONST` sections are meant to replace values. Other types, such as column names, are not supported:

```programlisting
...
| filter $DEVICE_NAME = "my_device"             // illegal
...
```

A few more points to keep in mind when writing `CONST` sections:

* `CONST` names are not case-sensitive. They can be written in any user-desired casing, such as UPPER\_SNAKE, lower\_snake, camelCase, and CamelCase. For example, `MY_CONST=My_Const=my_const`.
* `CONST` names must be unique inside a section, and across all sections of the file. You cannot have the same `CONST` name defined again in the same section, or in any other `CONST` sections in the file.
* Since section order is unimportant, you do not have to declare a `CONST` before using it. You can have the `CONST` section written below other sections that use those `CONST` sections.
* A `CONST` is an add-on to the Parsing Rule syntax and is optional to configure.
* `CONST` syntax is derived from XQL, but includes the modifications explained in [Parsing Rules file structure and syntax](/cortex-xdr-5.x/configure-cortex-xdr/data-management/parsing-rules/parsing-rules-file-structure-and-syntax.md).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/data-management/parsing-rules/parsing-rules-file-structure-and-syntax/const.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.