ipv6_is_in_any_range

You can use this function to:

Detect whether traffic originates from known internal or external networks.
Match IPv6 addresses against predefined address ranges for compliance or security auditing.
Filter datasets based on whether requesters fall into allowed or disallowed IP zones.

Usage#

Syntax#

ipv6_is_in_any_range(ipv6_address, ipv6_ranges)

Parameters#

Name	Type	Description
`ipv6_address`	`string`	An IPv6 address in standard format (for example, `2001:db8::1`).
`ipv6_ranges`	`dynamic array`	A JSON array of IPv6 CIDR strings to compare against.

Returns#

A bool value:

true if the given IPv6 address is within any of the provided CIDR ranges.
false otherwise.

Example#

You want to detect HTTP requests from a specific internal IPv6 block.

Query

['sample-http-logs']
| extend inRange = ipv6_is_in_any_range('2001:db8::1234', dynamic(['2001:db8::/32', 'fd00::/8']))
| project _time, uri, method, status, inRange

Run in Playground

Output

_time	uri	method	status	inRange
2025-06-30T01:00:00Z	/api/login	POST	200	true
2025-06-30T01:01:00Z	/healthcheck	GET	204	true

ipv4_is_in_any_range: Use this function when working with IPv4 addresses instead of IPv6.
ipv6_compare: Compares two IPv6 addresses. Use this for sorting or deduplication rather than range matching.
ipv6_is_match: Checks whether an IPv6 address matches a specific range. Use this if you need to test against a single CIDR block.

Other query languages#

Splunk SPL users

Splunk doesn’t offer a built-in function that directly checks if an IP falls within a list of CIDR ranges. Typically, SPL users must write custom logic using cidrmatch() repeatedly or rely on lookup tables.

Splunk example

| eval is_internal = if(cidrmatch("2001:db8::/32", ip), "true", "false")

APL equivalent

ipv6_is_in_any_range('2001:db8::1', dynamic(['2001:db8::/32']))

ANSI SQL users

ANSI SQL doesn’t natively support IPv6-aware CIDR range checks. Such functionality usually requires user-defined functions or external extensions.

SQL example

-- Typically handled via stored procedures or UDFs in extended SQL environments
SELECT ip, is_in_range(ip, '2001:db8::/32') FROM traffic_logs