format_ipv4

The format_ipv4 function in APL converts a numeric representation of an IPv4 address into its standard dotted-decimal format. This function is particularly useful when working with logs or datasets where IP addresses are stored as integers, making them hard to interpret directly.

You can use format_ipv4 to enhance log readability, enrich security logs, or convert raw telemetry data for analysis.

Usage

Syntax

format_ipv4(ipv4address)

Parameters

• ipv4address: A long numeric representation of the IPv4 address in network byte order.

Returns

• Returns a string representing the IPv4 address in dotted-decimal format.
• Returns an empty string if the conversion fails.

Use case example

When analyzing HTTP request logs, you can convert IP addresses stored as integers into a readable format to identify client locations or troubleshoot issues.

Query

['sample-http-logs']
| extend formatted_ip = format_ipv4(3232235776)

Output

This query decodes raw IP addresses into a human-readable format for easier analysis.

List of related functions

• has_any_ipv4: Matches any IP address in a string column with a list of IP addresses or ranges.
• has_ipv4: Checks if a single IP address is present in a string column.
• ipv4_compare: Compares two IPv4 addresses lexicographically. Use for sorting or range evaluations.
• parse_ipv4: Converts a dotted-decimal IP address into a numeric representation.

Other query languages