ipv6_is_match
This page explains how to use the ipv6_is_match function in APL.
Use the
Run in Playground
Output
ipv6_is_match function to determine whether an IPv6 address belongs to a specified IPv6 subnet. This function is useful when you want to classify, filter, or route network events based on IPv6 subnet membership.
You can use ipv6_is_match in scenarios such as identifying traffic from a known address range, enforcing access control policies, or correlating logs to specific networks. It supports CIDR notation for subnet specification and returns a boolean value for each row in your dataset.
For users of other query languages
If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.Splunk SPL users
Splunk SPL users
Splunk SPL does not have a dedicated function for matching IPv6 addresses against CIDR blocks. You typically use regular expressions or custom lookups to perform similar checks. In contrast, APL provides a built-in function that directly evaluates IPv6 CIDR membership.
ANSI SQL users
ANSI SQL users
ANSI SQL does not have a standard function to check if an IPv6 address belongs to a subnet. You often implement this logic with string manipulation or rely on database-specific functions. APL simplifies this with
ipv6_is_match, which accepts a full IPv6 address and a subnet in CIDR notation.Usage
Syntax
Parameters
| Name | Type | Description |
|---|---|---|
ipv6_address | string | The full IPv6 address you want to check. |
ipv6_subnet | string | The target subnet in CIDR notation, e.g., 2001:db8::/32. |
Returns
A boolean value:trueif theipv6_addressbelongs to the specifiedipv6_subnet.falseotherwise.
Example
Identify requests that originate from a known IPv6 subnet. Query| _time | uri | method | status | isInternal |
|---|---|---|---|---|
| 2025-06-28T13:04:10Z | /health | GET | 200 | true |
| 2025-06-28T13:05:22Z | /api/orders | POST | 201 | true |
List of related functions
- ipv4_is_match: Checks whether an IPv4 address belongs to a specified IPv4 subnet. Use it when working with IPv4 addresses.
- parse_ipv4: Parses a string into an IPv4 address. Use it when working with raw IPv4 strings.