ipv6_compare

You can use ipv6_compare in scenarios where IPv6 addresses are relevant, such as sorting traffic logs, grouping metrics by address ranges, or identifying duplicate or misordered entries. It’s especially useful in network observability and security use cases where working with IPv6 is common.

Usage#

Syntax#

ipv6_compare(ipv6_1, ipv6_2)

Parameters#

Returns#

An integer that represents the result of the comparison:

• -1 if ipv6_1 is less than ipv6_2
• 0 if ipv6_1 is equal to ipv6_2
• 1 if ipv6_1 is greater than ipv6_2

Example#

Use ipv6_compare to identify whether requests from certain IPv6 addresses fall into specific ranges or appear out of expected order.

Query

['sample-http-logs']
| extend comparison = ipv6_compare('2001:db8::1', '2001:db8::abcd')
| project _time, uri, method, status, comparison

Run in Playground

Output

This example compares two static IPv6 addresses and attaches the result to each row for further filtering or grouping.

List of related functions#

• ipv6_is_match: Checks if an IPv6 address matches a given subnet. Use it for range filtering instead of sorting or comparison.
• ipv4_is_private: Determines whether an IPv4 address is in a private range. Use this to filter non-public traffic.
• ipv4_compare: Works the same way as ipv6_compare but for IPv4 addresses. Use it when your data contains IPv4 instead of IPv6.

Other query languages#

| eval ip1 = "2001:db8::1", ip2 = "2001:db8::2"
| eval comparison = if(ip1 == ip2, 0, if(ip1 < ip2, -1, 1))

print comparison = ipv6_compare('2001:db8::1', '2001:db8::2')

SELECT CASE
  WHEN ip1 = ip2 THEN 0
  WHEN ip1 < ip2 THEN -1
  ELSE 1
END AS comparison
FROM my_table

print comparison = ipv6_compare('2001:db8::1', '2001:db8::2')