has_ipv4_prefix

Usage#

Syntax#

has_ipv4_prefix(column_name, prefix)

Parameters#

Parameter	Type	Description
`column_name`	string	The column containing the IPv4 addresses to evaluate.
`prefix`	string	The prefix to check for, expressed as a string (for example, "192.0").

Returns#

Returns a Boolean (true or false) indicating whether the IPv4 address starts with the specified prefix.

Use case example#

Use has_ipv4_prefix to filter logs for requests originating from a specific IP range.

Query

['sample-http-logs']
| extend has_prefix= has_ipv4_prefix('192.168.0.1', '192.168.')

Run in Playground

Output

_time	has_prefix	status
2024-11-14T10:00:00	true	200

has_any_ipv4: Matches any IP address in a string column with a list of IP addresses or ranges.
has_ipv4: Checks if a single IP address is present in a string column.

Other query languages#

Splunk SPL users

In Splunk SPL, you use string-based matching or CIDR functions for IP comparison. In APL, has_ipv4_prefix simplifies the process by directly comparing an IP against a prefix.

Splunk example

| eval is_match = if(cidrmatch("192.168.0.0/24", ip), true, false)

APL equivalent

['sample-http-logs']
| where has_ipv4_prefix(uri, "192.168.0")

ANSI SQL users

In ANSI SQL, there is no direct equivalent to has_ipv4_prefix. You would typically use substring or LIKE operators for partial matching. APL provides a dedicated function for this purpose, ensuring simplicity and accuracy.

SQL example

SELECT *
FROM sample_http_logs
WHERE ip LIKE '192.168.0%'