The format_ipv4 function in APL converts a numeric representation of an IPv4 address into its standard dotted-decimal format. This function is particularly useful when working with logs or datasets where IP addresses are stored as integers, making them hard to interpret directly.

You can use format_ipv4 to enhance log readability, enrich security logs, or convert raw telemetry data for analysis.

​
For users of other query languages

If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.

​
Usage

​
Syntax

format_ipv4(ipv4address)

​
Parameters

  • ipv4address: A long numeric representation of the IPv4 address in network byte order.

​
Returns

  • Returns a string representing the IPv4 address in dotted-decimal format.
  • Returns an empty string if the conversion fails.

​
Use case example

When analyzing HTTP request logs, you can convert IP addresses stored as integers into a readable format to identify client locations or troubleshoot issues.

Query

['sample-http-logs']
| extend formatted_ip = format_ipv4(3232235776)

Run in Playground

Output

_timeformatted_ipstatusurimethod
2024-11-14 10:00:00192.168.1.0200/api/productsGET

This query decodes raw IP addresses into a human-readable format for easier analysis.

  • has_any_ipv4: Matches any IP address in a string column with a list of IP addresses or ranges.
  • has_ipv4: Checks if a single IP address is present in a string column.
  • ipv4_compare: Compares two IPv4 addresses lexicographically. Use for sorting or range evaluations.
  • parse_ipv4: Converts a dotted-decimal IP address into a numeric representation.