> ## Documentation Index
> Fetch the complete documentation index at: https://axiom.co/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# ipv6_is_in_range

> This page explains how to use the ipv6_is_in_range function in APL.

Use the `ipv6_is_in_range` function to check whether an IPv6 address falls within a specified IPv6 CIDR range. This is useful when you need to classify, filter, or segment network traffic by address range—such as identifying requests from internal subnets, geo-localized regional blocks, or known malicious networks.

You can use this function when analyzing HTTP logs, trace telemetry, or security events where IPv6 addresses are present, and you want to restrict attention to or exclude certain address ranges.

## For users of other query languages

If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.

<AccordionGroup>
  <Accordion title="Splunk SPL users">
    In Splunk SPL, IP range checking for IPv6 addresses typically requires custom scripts or manual logic, as there is no built-in function equivalent to `ipv6_is_in_range`.

    ```sql Splunk example theme={null}
    | eval inRange=if(cidrmatch("2001:db8::/32", src_ip), "yes", "no")
    ```

    ```kusto APL equivalent theme={null}
    ['sample-http-logs']
    | extend inRange = ipv6_is_in_range(src_ip, '2001:db8::/32')
    ```
  </Accordion>

  <Accordion title="ANSI SQL users">
    ANSI SQL doesn’t have native functions for CIDR range checks on IPv6 addresses. You typically rely on user-defined functions (UDFs) or external tooling. In APL, `ipv6_is_in_range` provides this capability out of the box.

    ```sql SQL example theme={null}
    -- Using a hypothetical UDF
    SELECT ipv6_in_range(ip_address, '2001:db8::/32') AS in_range FROM logs;
    ```

    ```kusto APL equivalent theme={null}
    ['sample-http-logs']
    | extend inRange = ipv6_is_in_range(src_ip, '2001:db8::/32')
    ```
  </Accordion>
</AccordionGroup>

## Usage

### Syntax

```kusto theme={null}
ipv6_is_in_range(ipv6: string, cidr_range: string)
```

### Parameters

| Name         | Type   | Description                                   |
| ------------ | ------ | --------------------------------------------- |
| `ipv6`       | string | The IPv6 address to check.                    |
| `cidr_range` | string | The IPv6 CIDR block (e.g. `'2001:db8::/32'`). |

### Returns

A `bool` value:

* `true` if the IPv6 address is within the specified CIDR range.
* `false` otherwise.

## Example

Use this function to isolate internal service calls originating from a designated IPv6 block.

**Query**

```kusto theme={null}
['otel-demo-traces']
| extend inRange = ipv6_is_in_range('fd00::a1b2', 'fd00::/8')
| project _time, span_id, ['service.name'], duration, inRange
```

[Run in Playground](https://play.axiom.co/axiom-play-qf1k/query?initForm=%7B%22apl%22%3A%22%5B'otel-demo-traces'%5D%20%7C%20extend%20inRange%20%3D%20ipv6_is_in_range\('fd00%3A%3Aa1b2'%2C%20'fd00%3A%3A%2F8'\)%20%7C%20project%20_time%2C%20span_id%2C%20%5B'service.name'%5D%2C%20duration%2C%20inRange%22%7D)

**Output**

| \_time               | span\_id | \['service.name'] | duration   | inRange |
| -------------------- | -------- | ----------------- | ---------- | ------- |
| 2025-06-28T11:20:00Z | span-124 | frontend          | 00:00:02.4 | true    |
| 2025-06-28T11:21:03Z | span-209 | cartservice       | 00:00:01.1 | true    |

## List of related functions

* [ipv4\_is\_in\_range](/apl/scalar-functions/ip-functions/ipv4-is-in-range): Checks whether an IPv4 address is within a specified CIDR range. Use this function when working with IPv4 instead of IPv6.
* [ipv6\_compare](/apl/scalar-functions/ip-functions/ipv6-compare): Compares two IPv6 addresses. Use when you want to sort or test address equality or ordering.
* [ipv6\_is\_match](/apl/scalar-functions/ip-functions/ipv6-is-match): Checks whether an IPv6 address matches a pattern. Use for wildcard or partial-match filtering rather than range checking.