parse_ipv4

Usage#

Syntax#

parse_ipv4(ipv4_address)

Parameters#

Parameter	Type	Description
`ipv4_address`	string	The IPv4 address to parse into a long number.

Returns#

The function returns the IPv4 address as a long number if the conversion succeeds. If the conversion fails, the function returns null.

Use case example#

You can use the parse_ipv4 function to analyze web traffic by representing IP addresses as long numbers.

Query

['sample-http-logs']
| extend ip_long = parse_ipv4('192.168.1.1')

Run in Playground

Output

_time	uri	method	ip_long
2024-11-14T10:00:00	/index.html	GET	3,232,235,777

has_any_ipv4: Matches any IP address in a string column with a list of IP addresses or ranges.
has_ipv4_prefix: Checks if an IPv4 address matches a single prefix.
has_ipv4: Checks if a single IP address is present in a string column.
ipv4_compare: Compares two IPv4 addresses lexicographically. Use for sorting or range evaluations.
ipv4_is_in_range: Checks if an IP address is within a specified range.
ipv4_is_private: Checks if an IPv4 address is within private IP ranges.

Other query languages#

Splunk SPL users

Splunk doesn’t provide a direct function for converting an IPv4 address into a long number. However, you can achieve similar functionality using custom SPL expressions.

Splunk example

| eval ip_int = tonumber(replace(ip, "\\.", ""))

APL equivalent

['sample-http-logs']
| extend ip_long = parse_ipv4(uri)

ANSI SQL users

SQL doesn’t have a built-in function equivalent to parse_ipv4, but you can use bitwise operations to achieve a similar result.

SQL example

SELECT
  (CAST(SPLIT_PART(ip, '.', 1) AS INT) << 24) +
  (CAST(SPLIT_PART(ip, '.', 2) AS INT) << 16) +
  (CAST(SPLIT_PART(ip, '.', 3) AS INT) << 8) +
  CAST(SPLIT_PART(ip, '.', 4) AS INT) AS ip_int
FROM logs;