format_ipv4
You can use format_ipv4 to enhance log readability, enrich security logs, or convert raw telemetry data for analysis.
Usage#
Syntax#
format_ipv4(ipv4address)Parameters#
ipv4address: Alongnumeric representation of the IPv4 address in network byte order.
Returns#
- Returns a string representing the IPv4 address in dotted-decimal format.
- Returns an empty string if the conversion fails.
Use case example#
When analyzing HTTP request logs, you can convert IP addresses stored as integers into a readable format to identify client locations or troubleshoot issues.
Query
['sample-http-logs']
| extend formatted_ip = format_ipv4(3232235776)Output
| _time | formatted_ip | status | uri | method |
|---|---|---|---|---|
| 2024-11-14 10:00:00 | 192.168.1.0 | 200 | /api/products | GET |
This query decodes raw IP addresses into a human-readable format for easier analysis.
List of related functions#
- has_any_ipv4: Matches any IP address in a string column with a list of IP addresses or ranges.
- has_ipv4: Checks if a single IP address is present in a string column.
- ipv4_compare: Compares two IPv4 addresses lexicographically. Use for sorting or range evaluations.
- parse_ipv4: Converts a dotted-decimal IP address into a numeric representation.
Other query languages#
Splunk SPL users
In Splunk SPL, IPv4 address conversion is typically not a built-in function. You may need to use custom scripts or calculations. APL simplifies this process with the format_ipv4 function.
ANSI SQL users
ANSI SQL doesn’t have a built-in function for IPv4 formatting. You’d often use string manipulation or external utilities to achieve the same result. In APL, format_ipv4 offers a straightforward solution.