has_ipv4

Introduction#

To use has_ipv4, ensure that IP addresses in the text are properly delimited with non-alphanumeric characters. For example:

Valid: 192.168.1.1 in "Requests from: 192.168.1.1, 10.1.1.115."
Invalid: 192.168.1.1 in "192.168.1.1ThisText"

The function returns true if the IP address is valid and present in the text. Otherwise, it returns false.

Usage#

Syntax#

has_ipv4(source, ip_address)

Parameters#

Name	Type	Description
`source`	string	The source text where to search for the IP address.
`ip_address`	string	The IP address to look for in the source.

Returns#

true if ip_address is a valid IP address and is found in source.
false otherwise.

Use case example#

Identify requests coming from a specific IP address in HTTP logs.

Query

['sample-http-logs']
| extend has_ip = has_ipv4('Requests from: 192.168.1.1, 10.1.1.115.', '192.168.1.1')

Run in Playground

Output

_time	has_ip	status
2024-11-14T10:00:00	true	200

has_any_ipv4: Matches any IP address in a string column with a list of IP addresses or ranges.
has_ipv4_prefix: Checks if an IPv4 address matches a single prefix.

Other query languages#

Splunk SPL users

In Splunk SPL, you might use match or similar regex-based functions to locate IPv4 addresses in a string. In APL, has_ipv4 provides a simpler and more efficient alternative for detecting specific IPv4 addresses.

Splunk example

search sourcetype=access_combined | eval isPresent=match(_raw, "192\.168\.1\.1")

APL equivalent

print result=has_ipv4('05:04:54 192.168.1.1 GET /favicon.ico 404', '192.168.1.1')

ANSI SQL users

In ANSI SQL, locating IPv4 addresses often involves string manipulation or pattern matching with LIKE or regular expressions. APL’s has_ipv4 function provides a more concise and purpose-built approach.

SQL example

SELECT CASE WHEN column_text LIKE '%192.168.1.1%' THEN TRUE ELSE FALSE END AS result
FROM log_table;