> ## Documentation Index
> Fetch the complete documentation index at: https://axiom.co/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# ipv6_is_in_any_range

> This page explains how to use the ipv6_is_in_any_range function in APL.

Use the `ipv6_is_in_any_range` function to determine whether a given IPv6 address belongs to any of a specified set of IPv6 CIDR ranges. This function is particularly useful in log enrichment, threat detection, and network analysis tasks that involve validating or filtering IP addresses against allowlists or blocklists.

You can use this function to:

* Detect whether traffic originates from known internal or external networks.
* Match IPv6 addresses against predefined address ranges for compliance or security auditing.
* Filter datasets based on whether requesters fall into allowed or disallowed IP zones.

## For users of other query languages

If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.

<AccordionGroup>
  <Accordion title="Splunk SPL users">
    Splunk doesn’t offer a built-in function that directly checks if an IP falls within a list of CIDR ranges. Typically, SPL users must write custom logic using `cidrmatch()` repeatedly or rely on lookup tables.

    <CodeGroup>
      ```sql Splunk example theme={null}
      | eval is_internal = if(cidrmatch("2001:db8::/32", ip), "true", "false")
      ```

      ```kusto APL equivalent theme={null}
      ipv6_is_in_any_range('2001:db8::1', dynamic(['2001:db8::/32']))
      ```
    </CodeGroup>
  </Accordion>

  <Accordion title="ANSI SQL users">
    ANSI SQL doesn’t natively support IPv6-aware CIDR range checks. Such functionality usually requires user-defined functions or external extensions.

    <CodeGroup>
      ```sql SQL example theme={null}
      -- Typically handled via stored procedures or UDFs in extended SQL environments
      SELECT ip, is_in_range(ip, '2001:db8::/32') FROM traffic_logs
      ```

      ```kusto APL equivalent theme={null}
      ipv6_is_in_any_range('2001:db8::1', dynamic(['2001:db8::/32']))
      ```
    </CodeGroup>
  </Accordion>
</AccordionGroup>

## Usage

### Syntax

```kusto theme={null}
ipv6_is_in_any_range(ipv6_address, ipv6_ranges)
```

### Parameters

| Name           | Type            | Description                                               |
| -------------- | --------------- | --------------------------------------------------------- |
| `ipv6_address` | `string`        | An IPv6 address in standard format (e.g., `2001:db8::1`). |
| `ipv6_ranges`  | `dynamic array` | A JSON array of IPv6 CIDR strings to compare against.     |

### Returns

A `bool` value:

* `true` if the given IPv6 address is within any of the provided CIDR ranges.
* `false` otherwise.

## Example

You want to detect HTTP requests from a specific internal IPv6 block.

**Query**

```kusto theme={null}
['sample-http-logs']
| extend inRange = ipv6_is_in_any_range('2001:db8::1234', dynamic(['2001:db8::/32', 'fd00::/8']))
| project _time, uri, method, status, inRange
```

[Run in Playground](https://play.axiom.co/axiom-play-qf1k/query?initForm=%7B%22apl%22%3A%22%5B'sample-http-logs'%5D%20%7C%20extend%20inRange%20%3D%20ipv6_is_in_any_range\('2001%3Adb8%3A%3A1234'%2C%20dynamic\(%5B'2001%3Adb8%3A%3A%2F32'%2C%20'fd00%3A%3A%2F8'%5D\)\)%20%7C%20project%20_time%2C%20id%2C%20uri%2C%20method%2C%20status%2C%20inRange%22%7D)

**Output**

| \_time               | uri          | method | status | inRange |
| -------------------- | ------------ | ------ | ------ | ------- |
| 2025-06-30T01:00:00Z | /api/login   | POST   | 200    | true    |
| 2025-06-30T01:01:00Z | /healthcheck | GET    | 204    | true    |

## List of related functions

* [ipv4\_is\_in\_any\_range](/apl/scalar-functions/ip-functions/ipv4-is-in-any-range): Use this function when working with IPv4 addresses instead of IPv6.
* [ipv6\_compare](/apl/scalar-functions/ip-functions/ipv6-compare): Compares two IPv6 addresses. Use this for sorting or deduplication rather than range matching.
* [ipv6\_is\_match](/apl/scalar-functions/ip-functions/ipv6-is-match): Checks whether an IPv6 address matches a specific range. Use this if you need to test against a single CIDR block.