is_ipv4

Learn more about the Cortex Query Language is_ipv4() function.

Syntax

is_ipv4(<IPv4_address>)

Description

The is_ipv4() function accepts a string, and returns true if the string is a valid IPv4 address. The IPv4 address can be either an explicit string using quotes (""), such as "192.168.0.1", or a string field.

Note

The <IPv4_address> must contain an IPv4 address in an IPv4 field. For production purposes, this IPv4 address will normally be carried in a field that you retrieve from a dataset. For manual usage, assign the IPv4 address to a field, and then use that field with this function.

Example

Data table for ips_test_raw dataset

The example provided is based on the following data table for a dataset called ips_test_raw:

_TIME	IP	_VENDOR	_PRODUCT
Mar 26th 2025 19:26:07	1.1.1.1	ips	test
Mar 26th 2025 19:26:07	192.168.1.100	ips	test
Mar 26th 2025 19:26:07	FF0E::1	ips	test
Mar 26th 2025 19:26:07	127.0.0.1	ips	test
Mar 26th 2025 19:26:07	172.32.0.1	ips	test
Mar 26th 2025 19:26:07	2606:4700:4700::1111	ips	test

Query: Filter the IPv4 addresses

dataset = ips_test_raw
| alter IsIpv4 = is_ipv4(ip)
| filter IsIpv4

Output results table

Returns all the IPv4 addresses from the ip field in the ips_test_raw dataset. When the is_ipv4 function returns true, the results are displayed with a new IsIpv4 column (field) indicating a true value. If the function returns false, no results are returned.

_TIME	IP	_VENDOR	_PRODUCT	ISIPV4
Mar 26th 2025 19:26:07	1.1.1.1	ips	test	true
Mar 26th 2025 19:26:07	192.168.1.100	ips	test	true
Mar 26th 2025 19:26:07	127.0.0.1	ips	test	true
Mar 26th 2025 19:26:07	172.32.0.1	ips	test	true