Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Applies to: ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel
Returns a value indicating whether a specified IPv4 address prefix appears in a text.
A valid IP address prefix is either a complete IPv4 address (192.168.1.11) or its prefix ending with a dot (192., 192.168. or 192.168.1.).
IP address entrances in a text must be properly delimited with nonalphanumeric characters. For example, properly delimited IP addresses are:
- "These requests came from: 192.168.1.1, 10.1.1.115 and 10.1.1.201"
- "05:04:54 127.0.0.1 GET /favicon.ico 404"
Syntax
has_ipv4_prefix(source , ip_address_prefix )
Learn more about syntax conventions.
Parameters
| Name | Type | Required | Description |
|---|---|---|---|
| source | string |
✔️ | The text to search. |
| ip_address_prefix | string |
✔️ | The IP address prefix for which to search. |
Returns
true if the ip_address_prefix is a valid IPv4 address prefix, and it was found in source. Otherwise, the function returns false.
Tip
To search for many IPv4 prefixes at once, use the has_any_ipv4_prefix() function.
Examples
The following example shows how to use the has_ipv4_prefix function to search for a specific IPv4 address prefix within text.
print result=has_ipv4_prefix('05:04:54 127.0.0.1 GET /favicon.ico 404', '127.0.')
| result |
|---|
| true |
The following example demonstrates using has_ipv4_prefix with an invalid IP address prefix. The IP address in the text is properly delimited by nonalphanumeric characters.
print result=has_ipv4_prefix('05:04:54 127.0.0.1 GET /favicon.ico 404', '127.0')
| result |
|---|
| false |
The following example demonstrates using has_ipv4_prefix with an invalid IP address. The IP address in the text is properly delimited by nonalphanumeric characters.
print result=has_ipv4_prefix('05:04:54 127.0.0.256 GET /favicon.ico 404', '127.0.')
| result |
|---|
| false |
The following example demonstrates using has_ipv4_prefix with an improperly delimited IP address. The IP address in the text is improperly delimited by nonalphanumeric characters.
print result=has_ipv4_prefix('05:04:54127.0.0.1 GET /favicon.ico 404', '127.0.')
| result |
|---|
| false |