This page explains how to use the has_any_ipv4_prefix function in APL.
has_any_ipv4_prefix
function in APL lets you determine if an IPv4 address starts with any prefix in a list of specified prefixes. This function is particularly useful for filtering, segmenting, and analyzing data involving IP addresses, such as log data, network traffic, or security events. By efficiently checking prefixes, you can identify IP ranges of interest for purposes like geolocation, access control, or anomaly detection.
Splunk SPL users
has_any_ipv4_prefix
provides a direct and optimized way to perform this check.ANSI SQL users
LIKE
clauses combined with OR
operators to check prefixes. In APL, the has_any_ipv4_prefix
function simplifies this process by accepting a dynamic list of prefixes.Parameter | Type | Description |
---|---|---|
ip_column | string | The column containing the IPv4 address. |
prefixes | dynamic | A list of IPv4 prefixes to check against. |
true
if the IPv4 address matches any of the specified prefixes.false
otherwise._time | has_ip_prefix | status |
---|---|---|
2024-11-14T10:00:00 | true | 200 |