Edit

Share via


has_ipv4_prefix()

Applies to: ✅ Microsoft FabricAzure Data ExplorerAzure MonitorMicrosoft Sentinel

Returns a value indicating whether a specified IPv4 address prefix appears in a text.

A valid IP address prefix is either a complete IPv4 address (192.168.1.11) or its prefix ending with a dot (192., 192.168. or 192.168.1.).

IP address entrances in a text must be properly delimited with nonalphanumeric characters. For example, properly delimited IP addresses are:

  • "These requests came from: 192.168.1.1, 10.1.1.115 and 10.1.1.201"
  • "05:04:54 127.0.0.1 GET /favicon.ico 404"

Syntax

has_ipv4_prefix(source , ip_address_prefix )

Learn more about syntax conventions.

Parameters

Name Type Required Description
source string ✔️ The text to search.
ip_address_prefix string ✔️ The IP address prefix for which to search.

Returns

true if the ip_address_prefix is a valid IPv4 address prefix, and it was found in source. Otherwise, the function returns false.

Tip

To search for many IPv4 prefixes at once, use the has_any_ipv4_prefix() function.

Examples

The following example shows how to use the has_ipv4_prefix function to search for a specific IPv4 address prefix within text.

print result=has_ipv4_prefix('05:04:54 127.0.0.1 GET /favicon.ico 404', '127.0.')
result
true

The following example demonstrates using has_ipv4_prefix with an invalid IP address prefix. The IP address in the text is properly delimited by nonalphanumeric characters.

print result=has_ipv4_prefix('05:04:54 127.0.0.1 GET /favicon.ico 404', '127.0')
result
false

The following example demonstrates using has_ipv4_prefix with an invalid IP address. The IP address in the text is properly delimited by nonalphanumeric characters.

print result=has_ipv4_prefix('05:04:54 127.0.0.256 GET /favicon.ico 404', '127.0.')
result
false

The following example demonstrates using has_ipv4_prefix with an improperly delimited IP address. The IP address in the text is improperly delimited by nonalphanumeric characters.

print result=has_ipv4_prefix('05:04:54127.0.0.1 GET /favicon.ico 404', '127.0.')
result
false