> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/query-builder-templates/run-a-free-text-query.md). # Run a free text query You can use the **Free text** template to query your datasets for free-text strings without building a Cortex Query Language (XQL) query. The template queries all of the raw datasets that are stored in your tenant and returns up to 1,000 results. {% hint style="info" %} ### Note The query in free-text search in the Query Templates page runs only on raw datasets. You can only scope your search using the **`search`** stage available in the XQL editor.\ Use the **`search`** stage in the XQL editor to use scoping to query free-text strings in specific datasets, normalized datasets, or all datasets in your tenant. {% endhint %} ### How to run a free text query 1. Select **Investigation & Response** → **Query Templates**. 2. Under **General Search**, select **Free text**. 3. In the **Text Contains** field, type one or more strings. Separate multiple strings with pipes, which applies the OR operator. 4. Click **TIME** and select a time frame for the query.

Note

Free text search is limited to the last 90 days of data. Specifying a time frame outside of this limitation will cause the query to fail.

5. Click **Run** to start the query, or click **Schedule** to run the query at a specific time. Free text search searches the relevant columns in each dataset. Relevant columns are subject to a change and can vary between datasets. You can also click **Continue in XQL** to translate the query with the fields that you specified into XQL. In XQL you have the flexibility to add additional stages and functions that are not available in the Query Builder templates. 6. Review the results. The searched string is highlighted in the results. In the **Fields** column, you can see all of the fields in which the string was discovered. Fields are listed in the following order: (1) `_time`, (2) `_dataset`, and (3) the fields in which the string was discovered, ordered by highest to lowest number of hits. In the `RAW_DATA` column, click **Show more** to see the specific row in the dataset in which the string was discovered. ### **What to do next** * To edit or rerun the query, click **Back to edit** to review the template in the Query Builder, or **Continue in XQL** to review the XQL. * Practice running queries with [Query Builder template examples](/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/query-builder-templates/query-builder-template-examples.md). --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/query-builder-templates/run-a-free-text-query.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.