has_any_ipv4_prefix

Usage#

Syntax#

has_any_ipv4_prefix(ip_column, prefixes)

Parameters#

Parameter	Type	Description
`ip_column`	`string`	The column containing the IPv4 address.
`prefixes`	`dynamic`	A list of IPv4 prefixes to check against.

Returns#

true if the IPv4 address matches any of the specified prefixes.
false otherwise.

Use case example#

Detect requests from specific IP ranges.

Query

['sample-http-logs']
| extend has_ip_prefix = has_any_ipv4_prefix('192.168.0.1', dynamic(['172.16.', '192.168.']))

Run in Playground

Output

_time	has_ip_prefix	status
2024-11-14T10:00:00	true	200

has_any_ipv4: Matches any IP address in a string column with a list of IP addresses or ranges.
has_ipv4_prefix: Checks if an IPv4 address matches a single prefix.
has_ipv4: Checks if a single IP address is present in a string column.

Other query languages#

Splunk SPL users

In Splunk SPL, checking if an IP address matches a prefix requires custom search logic with pattern matching or conditional expressions. In APL, has_any_ipv4_prefix provides a direct and optimized way to perform this check.

Splunk example

| eval is_in_range=if(match(ip, "10.*") OR match(ip, "192.168.*"), 1, 0)

APL equivalent

['sample-http-logs']
| where has_any_ipv4_prefix(uri, dynamic(['10.', '192.168.']))

ANSI SQL users

In ANSI SQL, you need to use LIKE clauses combined with OR operators to check prefixes. In APL, the has_any_ipv4_prefix function simplifies this process by accepting a dynamic list of prefixes.

SQL example

SELECT * FROM logs
WHERE ip LIKE '10.%' OR ip LIKE '192.168.%';