> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/concat.md).

# concat

Use the `concat()` function to join two or more strings into a single, cohesive string.

## Syntax

```sql
concat (<string1>, <string2>, ...)
```

## Parameters

| Name                      | Type   | Required | Description                                                                           |
| ------------------------- | ------ | -------- | ------------------------------------------------------------------------------------- |
| `string1`, `string2`, ... | string | Yes      | The string expressions whose values will be joined. Two or more strings are required. |

## Returns

The `concat()` function returns a single string.

## Usage notes

* The function strictly accepts string parameters.
* The `concat()` function will not perform any implicit conversion of other data types to strings.
* Explicit `to_string()` conversion is necessary for non-string values (such as integers, floats, or booleans) to ensure type compatibility.
* If any of the values passed to `concat()` are `NULL`, the function will return `NULL`.

## Examples

### Example 1: Concatenating two string literal values

**Goal**: Join two static string values into a new field.

**XQL code**:

```sql
config timeframe = 1d 
| dataset = sample_xql_raw 
| alter static_message = concat("Investigation: ", "Started") 
| fields event_id, static_message 
| limit 3
```

**Explanation**: For each record, the `concat()` function combines the two literal strings "Investigation: " and "Started", resulting in the value "Investigation: Started" for all records.

**Output**:

| EVENT\_ID | STATIC\_MESSAGE          |
| --------- | ------------------------ |
| 101       | "Investigation: Started" |
| 102       | "Investigation: Started" |
| 103       | "Investigation: Started" |

### Example 2: Concatenating a string literal with a field value

**Goal**: Join a fixed string prefix with the value of an existing field.

**XQL code**:

```sql
config timeframe = 1d 
| dataset = sample_xql_raw 
| alter event_label = concat("Event ID: ", to_string(event_id)) 
| fields event_id, event_label 
| limit 3
```

**Explanation**: The `to_string(event_id)` function converts the numeric `event_id` into its string representation. `concat()` then joins the literal string "Event ID: " with the string version of the `event_id`, creating a unique `event_label` for each record.

**Output**:

| EVENT\_ID | EVENT\_LABEL    |
| --------- | --------------- |
| 101       | "Event ID: 101" |
| 102       | "Event ID: 102" |
| 103       | "Event ID: 103" |

### Example 3: Concatenating multiple field values

**Goal**: Combine values from multiple existing fields into a single string.

**XQL code**:

```sql
config timeframe = 1d 
| dataset = sample_xql_raw 
| alter event_summary = concat(event_description, " (Success: ", to_string(is_successful), ", Duration: ", to_string(duration_seconds), ")") 
| fields event_id, event_description, is_successful, duration_seconds, event_summary 
| limit 3
```

**Explanation**: The functions `to_string(is_successful)` and `to_string(duration_seconds)` convert the boolean and numeric fields into strings. `concat()` then combines `event_description`, literal strings like " (Success: ", and the converted string representations into `event_summary`.

**Output**:

| EVENT\_ID | EVENT\_DESCRIPTION               | IS\_SUCCESSFUL | DURATION\_SECONDS | EVENT\_SUMMARY                                                   |
| --------- | -------------------------------- | -------------- | ----------------- | ---------------------------------------------------------------- |
| 101       | "User login successful"          | true           | 1.5               | "User login successful (Success: true, Duration: 1.5)"           |
| 102       | "File access attempt"            | false          | 0.8               | "File access attempt (Success: false, Duration: 0.8)"            |
| 103       | "Network connection established" | true           | 10.2              | "Network connection established (Success: true, Duration: 10.2)" |

### Example 4: Concatenating extracted JSON scalar values

**Goal**: Use `concat()` with values extracted from a JSON field.

**XQL code**:

```sql
config timeframe = 1d 
| dataset = sample_xql_raw 
| alter status_code_value = coalesce(simple_json_data -> code, simple_json_data -> error_code) 
| alter full_status_message = concat("Status: ", status_code_value) 
| fields event_id, simple_json_data, status_code_value, full_status_message 
| limit 3
```

**Explanation**: The `coalesce` function attempts to get either `code` or `error_code` from `simple_json_data` as a string. `concat()` combines "Status: " with the extracted `status_code_value`. Because `concat()` returns `NULL` if any input is `NULL`, `full_status_message` is `NULL` for event 103 where neither key exists.

**Output**:

| EVENT\_ID | SIMPLE\_JSON\_DATA                                | STATUS\_CODE\_VALUE | FULL\_STATUS\_MESSAGE    |
| --------- | ------------------------------------------------- | ------------------- | ------------------------ |
| 101       | {"status": "ok", "code": 200}                     | "200"               | "Status: 200"            |
| 102       | {"status": "fail", "error": "access\_denied"}     | "access\_denied"    | "Status: access\_denied" |
| 103       | {"connection\_id": "CONN-001", "protocol": "TCP"} | NULL                | NULL                     |

## Example 5: Concatenating converted boot time values

**Goal**: Use `concat()` to prepend a string prefix to a converted timestamp field.

**XQL code**:

```sql
dataset = xdr_data 
| fields action_boot_time as abt 
| filter abt != null 
| alter abt_string = concat("str: ", to_string(abt)) 
| limit 1
```

**Explanation**: The query filters the `xdr_data` dataset to find the first record where `action_boot_time` is not `NULL`. Since `action_boot_time` is typically a numeric or timestamp type, the `to_string()` function is used to convert it before the `concat()` function joins it with the literal prefix `"str: "`.

**Output**:

| ABT        | ABT\_STRING       |
| ---------- | ----------------- |
| 1675238400 | "str: 1675238400" |

## Related articles

* **Stages**: [`alter`](/xql-command-reference-guide/readme/stages/alter.md), [`config`](/xql-command-reference-guide/readme/stages/config.md), [`fields`](/xql-command-reference-guide/readme/stages/fields.md), [`limit`](/xql-command-reference-guide/readme/stages/limit.md)
* **Functions**: [`coalesce`](/xql-command-reference-guide/readme/functions/coalesce.md), [`to_string`](/xql-command-reference-guide/readme/functions/to_string.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/concat.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.