> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/bitwise_sleft.md). # bitwise\_sleft Use the `bitwise_sleft()` function to perform a bitwise left shift operation on an integer value by a specified number of positions. ## Syntax ```sql bitwise_sleft (, ) ``` ## Parameters | Name | Type | Required | Description | | -------------- | ------- | -------- | ------------------------------------------------------------- | | `left_clause` | integer | Yes | The integer value or field whose bits are to be shifted left. | | `right_clause` | integer | Yes | The number of bit positions to shift left. | ## Returns The `bitwise_sleft()` function returns an integer representing the result of shifting the bits of the first parameter to the left by the number of positions specified in the second parameter. ## Usage notes * The function performs a bitwise left shift (`<<`) operation, moving each bit of the value to the left by the specified number of positions. New bits on the right are filled with 0. * Each left shift by 1 position effectively multiplies the value by 2. Shifting left by `n` positions multiplies the value by 2^n. * Both parameters must be integers. Passing a string value will result in a validation error. * This function is useful for constructing bitmask values, scaling values by powers of two, or encoding data into specific bit positions. * The function is typically used within the `alter` or `filter` stages to create computed fields or filter events based on bitwise conditions. ## Examples ### Example 1: Shift a field value left by 1 position **Goal**: Double the value of the `event_type` field by shifting its bits one position to the left. **XQL code**: ```sql config timeframe = 1d | dataset = xdr_data | alter doubled_type = bitwise_sleft(event_type, 1) | fields event_id, event_type, doubled_type | limit 3 ``` **Explanation**: This query shifts the bits of `event_type` one position to the left, effectively multiplying by 2. For a value of 5 (binary `101`), the result is 10 (binary `1010`). **Output**: | event\_id | event\_type | doubled\_type | | --------- | ----------- | ------------- | | 101 | 5 | 10 | | 102 | 3 | 6 | | 103 | 7 | 14 | ### Example 2: Create a bitmask from a bit position **Goal**: Convert a bit position number into its corresponding bitmask value by shifting 1 to the left. **XQL code**: ```sql config timeframe = 1d | dataset = xdr_data | alter bitmask = bitwise_sleft(1, bit_position) | fields event_id, bit_position, bitmask | limit 3 ``` **Explanation**: This query creates a bitmask by shifting the value 1 left by the number of positions specified in `bit_position`. For position 3, the result is 8 (binary `1000`). For position 0, the result is 1 (binary `1`). **Output**: | event\_id | bit\_position | bitmask | | --------- | ------------- | ------- | | 101 | 0 | 1 | | 102 | 3 | 8 | | 103 | 7 | 128 | ### Example 3: Scale a value by a power of two and filter **Goal**: Multiply the `action_status` field by 256 (2^8) by shifting left 8 positions, then filter for results above a threshold. **XQL code**: ```sql config timeframe = 1d | dataset = xdr_data | alter upper_byte = bitwise_sleft(action_status, 8) | filter upper_byte > 512 | fields event_id, action_status, upper_byte | limit 3 ``` **Explanation**: This query shifts `action_status` left by 8 positions, multiplying it by 256. For a value of 3, the result is 768. Only results greater than 512 pass the filter. **Output**: | event\_id | action\_status | upper\_byte | | --------- | -------------- | ----------- | | 102 | 3 | 768 | | 103 | 10 | 2560 | | 105 | 5 | 1280 | ## Related articles * **Stages**: [`alter`](/xql-command-reference-guide/readme/stages/alter.md), [`config`](/xql-command-reference-guide/readme/stages/comp.md), [`filter`](/xql-command-reference-guide/readme/stages/filter.md), [`fields`](/xql-command-reference-guide/readme/stages/fields.md), [`limit`](/xql-command-reference-guide/readme/stages/limit.md) * **Functions**: [`bitwise_sright`](/xql-command-reference-guide/readme/functions/bitwise_sright.md), [`bitwise_and`](/xql-command-reference-guide/readme/functions/bitwise_and.md), [`bitwise_or`](/xql-command-reference-guide/readme/functions/bitwise_or.md), [`bitwise_xor`](/xql-command-reference-guide/readme/functions/bitwise_xor.md), [`to_integer`](/xql-command-reference-guide/readme/functions/to_integer.md) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/bitwise_sleft.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.