ipv4_is_in_range
This page explains how to use the ipv4_is_in_range function in APL.
The ipv4_is_in_range function in Axiom Processing Language (APL) determines whether an IPv4 address falls within a specified range of addresses. This function is particularly useful for filtering or grouping logs based on geographic regions, network blocks, or security zones.
You can use this function to:
- Analyze logs for requests originating from specific IP address ranges.
- Detect unauthorized or suspicious activity by isolating traffic outside trusted IP ranges.
- Aggregate metrics for specific IP blocks or subnets.
Usage
Syntax
ipv4_is_in_range(ip: string, range: string)Parameters
| Parameter | Type | Description |
|---|---|---|
ip | string | The IPv4 address to evaluate. |
range | string | The IPv4 range in CIDR notation (for example, 192.168.1.0/24). |
Returns
trueif the IPv4 address is in the range.falseotherwise.nullif the conversion of a string wasn’t successful.
Use case example
You can use ipv4_is_in_range to identify traffic from specific geographic regions or service provider IP blocks.
Query
['sample-http-logs']
| extend in_range = ipv4_is_in_range('192.168.1.0', '192.168.1.0/24')Output
| geo.city | in_range |
|---|---|
| Seattle | true |
| Denver | true |
This query identifies the number of requests from IP addresses in the specified range.
List of related functions
- ipv4_compare: Compares two IPv4 addresses lexicographically. Use for sorting or range evaluations.
- ipv4_is_private: Checks if an IPv4 address is within private IP ranges.
- parse_ipv4: Converts a dotted-decimal IP address into a numeric representation.