has_ipv4_prefix
This page explains how to use the has_ipv4_prefix function in APL.
The has_ipv4_prefix function checks if an IPv4 address starts with a specified prefix. Use this function to filter or match IPv4 addresses efficiently based on their prefixes. It’s particularly useful when analyzing network traffic, identifying specific address ranges, or working with CIDR-based IP filtering in datasets.
Usage
Syntax
has_ipv4_prefix(column_name, prefix)Parameters
| Parameter | Type | Description |
|---|---|---|
column_name | string | The column containing the IPv4 addresses to evaluate. |
prefix | string | The prefix to check for, expressed as a string (for example, "192.0"). |
Returns
- Returns a Boolean (
trueorfalse) indicating whether the IPv4 address starts with the specified prefix.
Use case example
Use has_ipv4_prefix to filter logs for requests originating from a specific IP range.
Query
['sample-http-logs']
| extend has_prefix= has_ipv4_prefix('192.168.0.1', '192.168.')Output
| _time | has_prefix | status |
|---|---|---|
| 2024-11-14T10:00:00 | true | 200 |
List of related functions
- has_any_ipv4: Matches any IP address in a string column with a list of IP addresses or ranges.
- has_ipv4: Checks if a single IP address is present in a string column.