Axiom
Overview

geo_info_from_ip_address

Usage#

Syntax#

geo_info_from_ip_address(ip_address)

Parameters#

Parameter Type Description
ip_address string The IP address for which to retrieve geographic information.

Returns#

A dynamic object containing the IP address’s geographic attributes (if available). The object contains the following fields:

Name Type Description
country string Country name
state string State (subdivision) name
city string City name
latitude real Latitude coordinate
longitude real Longitude coordinate
country_iso string ISO code of the country
time_zone string Time zone in which the IP address is located

Use case example#

Use geographic data to analyze web log traffic.

Query

['sample-http-logs']
| extend geo_info = geo_info_from_ip_address('172.217.22.14')

Run in Playground

Output

geo_info

{
  "state": "",
  "longitude": -97.822,
  "latitude": 37.751,
  "country_iso": "US",
  "country": "United States",
  "city": "",
  "time_zone": "America/Chicago"
}

This query identifies the geographic location of the IP address 172.217.22.14.

  • has_any_ipv4: Matches any IP address in a string column with a list of IP addresses or ranges.
  • has_ipv4: Checks if a single IP address is present in a string column.
  • ipv4_is_in_range: Checks if an IP address is within a specified range.
  • ipv4_is_private: Checks if an IPv4 address is within private IP ranges.

IPv4 Examples#

Extract geolocation information from IPv4 address#

['sample-http-logs']
| extend ip_location = geo_info_from_ip_address('172.217.11.4')

Run in Playground

Project geolocation information from IPv4 address#

['sample-http-logs']
| project ip_location=geo_info_from_ip_address('20.53.203.50')

Run in Playground

Filter geolocation information from IPv4 address#

['sample-http-logs']
| extend ip_location = geo_info_from_ip_address('20.53.203.50')
| where ip_location.country == "Australia" and ip_location.country_iso == "AU" and ip_location.state == "New South Wales"

Run in Playground

Group geolocation information from IPv4 address#

['sample-http-logs']
| extend ip_location = geo_info_from_ip_address('20.53.203.50')
| summarize Count=count() by ip_location.state, ip_location.city, ip_location.latitude, ip_location.longitude

Run in Playground

IPv6 Examples#

Extract geolocation information from IPv6 address#

['sample-http-logs']
| extend ip_location = geo_info_from_ip_address('2607:f8b0:4005:805::200e')

Run in Playground

Project geolocation information from IPv6 address#

['sample-http-logs']
| project ip_location=geo_info_from_ip_address('2a03:2880:f12c:83:face:b00c::25de')

Run in Playground

Filter geolocation information from IPv6 address#

['sample-http-logs']
| extend ip_location = geo_info_from_ip_address('2a03:2880:f12c:83:face:b00c::25de')
| where ip_location.country == "United States" and ip_location.country_iso == "US" and ip_location.state == "Florida"

Run in Playground

Group geolocation information from IPv6 address#

['sample-http-logs']
| extend ip_location = geo_info_from_ip_address('2a03:2880:f12c:83:face:b00c::25de')
| summarize Count=count() by ip_location.state, ip_location.city, ip_location.latitude, ip_location.longitude

Run in Playground

Other query languages#

Splunk SPL users

In Splunk, the equivalent process often involves using lookup tables or add-ons to resolve IP addresses into geographic details. In APL, geo_info_from_ip_address performs the resolution natively within the query, streamlining the workflow.

Splunk example

| eval geo_info = iplocation(client_ip)

APL equivalent

['sample-http-logs']
| extend geo_info = geo_info_from_ip_address(client_ip)
ANSI SQL users

In SQL, geographic information retrieval typically requires a separate database or API integration. In APL, the geo_info_from_ip_address function directly provides geographic details, simplifying the query process.

SQL example

SELECT ip_to_location(client_ip) AS geo_info
FROM sample_http_logs

APL equivalent

['sample-http-logs']
| extend geo_info = geo_info_from_ip_address(client_ip)

Updated

Was this page helpful?