ipv4_compare

Usage#

Syntax#

ipv4_compare(ip1, ip2)

Parameters#

Parameter	Type	Description
`ip1`	string	The first IPv4 address to compare.
`ip2`	string	The second IPv4 address to compare.

Returns#

Returns 1 if the long representation of ip1 is greater than the long representation of ip2
Returns 0 if the long representation of ip1 is equal to the long representation of ip2
Returns -1 if the long representation of ip1 is less than the long representation of ip2
Returns null if the conversion fails.

Use case example#

You can use ipv4_compare to sort logs based on IP addresses or to identify connections between specific IPs.

Query

['sample-http-logs']
| extend ip1 = '192.168.1.1', ip2 = '192.168.1.10'
| extend comparison = ipv4_compare(ip1, ip2)

Run in Playground

Output

ip1	ip2	comparison
192.168.1.1	192.168.1.10	-1

This query compares two hardcoded IP addresses. It returns -1, indicating that 192.168.1.1 is lexicographically less than 192.168.1.10.

ipv4_is_in_range: Checks if an IP address is within a specified range.
ipv4_is_private: Checks if an IPv4 address is within private IP ranges.
parse_ipv4: Converts a dotted-decimal IP address into a numeric representation.

Other query languages#

Splunk SPL users

In Splunk SPL, similar functionality can be achieved using sort or custom commands. In APL, ipv4_compare is a dedicated function for comparing two IPv4 addresses.

Splunk example

| eval comparison = if(ip1 < ip2, -1, if(ip1 == ip2, 0, 1))

APL equivalent

| extend comparison = ipv4_compare(ip1, ip2)

ANSI SQL users

In ANSI SQL, you might manually parse or order IP addresses as strings. In APL, ipv4_compare simplifies this task with built-in support for IPv4 comparison.

SQL example

SELECT CASE
  WHEN ip1 < ip2 THEN -1
  WHEN ip1 = ip2 THEN 0
  ELSE 1
END AS comparison
FROM ips;