> ## Documentation Index
> Fetch the complete documentation index at: https://axiom.co/docs/llms.txt
> Use this file to discover all available pages before exploring further.

<AgentInstructions>

## Submitting Feedback

If you encounter incorrect, outdated, or confusing documentation on this page, submit feedback:

POST https://axiom.co/docs/feedback

```json
{
  "path": "/apl/scalar-functions/ip-functions/has-ipv4-prefix",
  "feedback": "Description of the issue"
}
```

Only submit feedback when you have something specific and actionable to report.

</AgentInstructions>

# has_ipv4_prefix

> This page explains how to use the has_ipv4_prefix function in APL.

The `has_ipv4_prefix` function checks if an IPv4 address starts with a specified prefix. Use this function to filter or match IPv4 addresses efficiently based on their prefixes. It’s particularly useful when analyzing network traffic, identifying specific address ranges, or working with CIDR-based IP filtering in datasets.

## For users of other query languages

If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.

<AccordionGroup>
  <Accordion title="Splunk SPL users">
    In Splunk SPL, you use string-based matching or CIDR functions for IP comparison. In APL, `has_ipv4_prefix` simplifies the process by directly comparing an IP against a prefix.

    <CodeGroup>
      ```sql Splunk example theme={null}
      | eval is_match = if(cidrmatch("192.168.0.0/24", ip), true, false)
      ```

      ```kusto APL equivalent theme={null}
      ['sample-http-logs']
      | where has_ipv4_prefix(uri, "192.168.0")
      ```
    </CodeGroup>
  </Accordion>

  <Accordion title="ANSI SQL users">
    In ANSI SQL, there is no direct equivalent to `has_ipv4_prefix`. You would typically use substring or LIKE operators for partial matching. APL provides a dedicated function for this purpose, ensuring simplicity and accuracy.

    <CodeGroup>
      ```sql SQL example theme={null}
      SELECT *
      FROM sample_http_logs
      WHERE ip LIKE '192.168.0%'
      ```

      ```kusto APL equivalent theme={null}
      ['sample-http-logs']
      | where has_ipv4_prefix(uri, "192.168.0")
      ```
    </CodeGroup>
  </Accordion>
</AccordionGroup>

## Usage

### Syntax

```kusto theme={null}
has_ipv4_prefix(column_name, prefix)
```

### Parameters

| Parameter     | Type   | Description                                                     |
| ------------- | ------ | --------------------------------------------------------------- |
| `column_name` | string | The column containing the IPv4 addresses to evaluate.           |
| `prefix`      | string | The prefix to check for, expressed as a string (e.g., "192.0"). |

### Returns

* Returns a Boolean (`true` or `false`) indicating whether the IPv4 address starts with the specified prefix.

## Use case example

Use `has_ipv4_prefix` to filter logs for requests originating from a specific IP range.

**Query**

```kusto theme={null}
['sample-http-logs']
| extend has_prefix= has_ipv4_prefix('192.168.0.1', '192.168.')
```

[Run in Playground](https://play.axiom.co/axiom-play-qf1k/query?initForm=%7B%22apl%22%3A%22%5B'sample-http-logs'%5D%20%7C%20extend%20has_prefix%3D%20has_ipv4_prefix\('192.168.0.1'%2C%20'192.168.'\)%22%7D)

**Output**

| \_time              | has\_prefix | status |
| ------------------- | ----------- | ------ |
| 2024-11-14T10:00:00 | true        | 200    |

## List of related functions

* [has\_any\_ipv4](/apl/scalar-functions/ip-functions/has-any-ipv4): Matches any IP address in a string column with a list of IP addresses or ranges.
* [has\_ipv4](/apl/scalar-functions/ip-functions/has-ipv4): Checks if a single IP address is present in a string column.