query parts join method

uncoder-core/app/translator/core/render.py

@@ -197,6 +197,7 @@ class PlatformQueryRender(QueryRender):
     not_token = "not"
 
     group_token = "(%s)"
+    query_parts_delimiter = " "
 
     field_value_map = BaseQueryFieldValue(or_token=or_token)
 
@@ -284,6 +285,10 @@ def wrap_query_with_meta_info(self, meta_info: MetaInfoContainer, query: str) ->
     def _finalize_search_query(query: str) -> str:
         return query
 
+    def _join_query_parts(self, prefix: str, query: str, functions: str) -> str:
+        parts = filter(lambda s: bool(s), map(str.strip, [prefix, self._finalize_search_query(query), functions]))
+        return self.query_parts_delimiter.join(parts)
+
     def finalize_query(
         self,
         prefix: str,
@@ -295,8 +300,7 @@ def finalize_query(
         *args,  # noqa: ARG002
         **kwargs,  # noqa: ARG002
     ) -> str:
-        parts = filter(lambda s: bool(s), map(str.strip, [prefix, self._finalize_search_query(query), functions]))
-        query = " ".join(parts)
+        query = self._join_query_parts(prefix, query, functions)
         query = self.wrap_query_with_meta_info(meta_info=meta_info, query=query)
         if not_supported_functions:
             rendered_not_supported = self.render_not_supported_functions(not_supported_functions)
@@ -383,7 +387,7 @@ def _generate_from_tokenized_query_container(self, query_container: TokenizedQue
                     defined_raw_log_fields = self.generate_raw_log_fields(
                         fields=query_container.meta_info.query_fields, source_mapping=source_mapping
                     )
-                    prefix += f"\n{defined_raw_log_fields}\n"
+                    prefix += f"\n{defined_raw_log_fields}"
                 result = self.generate_query(tokens=query_container.tokens, source_mapping=source_mapping)
             except StrictPlatformException as err:
                 errors.append(err)

uncoder-core/app/translator/platforms/palo_alto/renders/cortex_xsiam.py

@@ -147,6 +147,7 @@ class CortexXQLQueryRender(PlatformQueryRender):
     or_token = "or"
     and_token = "and"
     not_token = "not"
+    query_parts_delimiter = "\n"
 
     field_value_map = CortexXQLFieldValue(or_token=or_token)
     comment_symbol = "//"