> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/ip_to_int.md).

# ip\_to\_int

Use the `ip_to_int()` function to safely convert a string representation of an IPv4 address into its signed integer equivalent.

## Syntax

```sql
ip_to_int (<IPv4_address>)
```

## Parameters

| Name           | Type   | Required | Description                                        |
| -------------- | ------ | -------- | -------------------------------------------------- |
| `IPv4_address` | string | Yes      | The string representation of a valid IPv4 address. |

## Returns

The `ip_to_int()` function returns the signed integer representation of the provided IPv4 address string.

## Usage notes

* This function is designed to safely convert a string representation of an IPv4 address into its signed integer equivalent.
* This conversion is crucial for scenarios where numerical operations or comparisons are required on IP addresses, or for storing them in an integer format.
* `ip_to_int()` is the inverse of `int_to_ip()`, which converts an integer representation of an IPv4 address back to its string format.
* This function was previously known as `safe_ip_to_int()`.
* If the input `IPv4_address` is `NULL`, the function returns `NULL`.

## Examples

### Example 1: Converting a literal IPv4 address string

**Goal**: Convert a static string representation of an IPv4 address into its integer form.

**XQL code**:

```sql
config timeframe = 1d 
| dataset = sample_xql_raw 
| alter converted_ip_int = ip_to_int("48.49.50.51") // Converts the literal string "48.49.50.51" to an integer 
| fields event_id, converted_ip_int 
| limit 3 
```

**Explanation**: The query creates a new field `converted_ip_int` by converting the literal IPv4 string "48.49.50.51" to its integer equivalent, which is 808530483. This value is constant across all returned records.

**Output**:

| EVENT\_ID | CONVERTED\_IP\_INT |
| --------- | ------------------ |
| 101       | 808530483          |
| 102       | 808530483          |
| 103       | 808530483          |

### Example 2: Converting an IPv4 address from a dataset field

**Goal**: Apply the function to the `ipv4_address` field present in the dataset.

**XQL code**:

```sql
config timeframe = 1d 
| dataset = sample_xql_raw 
| alter converted_ip_from_field = ip_to_int(ipv4_address) // Converts the ipv4_address field to an integer 
| fields event_id, ipv4_address, converted_ip_from_field 
| limit 6 
```

**Explanation**: For each record, `ipv4_address` is converted to its integer representation in the `converted_ip_from_field`. Records with a `NULL` `ipv4_address` (like `event_id` 103) will also result in a `NULL` `converted_ip_from_field`.

**Output**:

| EVENT\_ID | IPV4\_ADDRESS  | CONVERTED\_IP\_FROM\_FIELD |
| --------- | -------------- | -------------------------- |
| 101       | 192.168.1.10   | 3232235786                 |
| 102       | 10.0.0.5       | 167772165                  |
| 103       | NULL           | NULL                       |
| 104       | 172.31.255.255 | 2892780543                 |
| 105       | 192.168.10.20  | 3232238100                 |
| 106       | 203.0.113.15   | 3407889679                 |

### Example 3: Handling NULL input

**Goal**: Demonstrate behavior when provided with a `NULL` input, by filtering for records where `ipv4_address` is `NULL`.

**XQL code**:

```sql
config timeframe = 1d 
| dataset = sample_xql_raw 
| filter ipv4_address = null // Focus on records where ipv4_address is NULL 
| alter converted_null_ip_int = ip_to_int(ipv4_address) // Attempts conversion of NULL 
| fields event_id, ipv4_address, converted_null_ip_int 
| limit 3 
```

**Explanation**: As is standard behavior for XQL functions when encountering null inputs, `ip_to_int()` returns `NULL` when its input `ipv4_address` is `NULL`.

**Output**:

| EVENT\_ID | IPV4\_ADDRESS | CONVERTED\_NULL\_IP\_INT |
| --------- | ------------- | ------------------------ |
| 103       | NULL          | NULL                     |
| 107       | NULL          | NULL                     |
| 109       | NULL          | NULL                     |

### Example 4: Converting a private IPv4 address

**Goal**: Target a specific private IPv4 address from the dataset to demonstrate its conversion.

**XQL code**:

```sql
config timeframe = 1d 
| dataset = sample_xql_raw 
| filter event_id = 102 // Selects event with a private IP: 10.0.0.5 
| alter private_ip_as_int = ip_to_int(ipv4_address) // Converts the private IPv4 string to integer 
| fields event_id, ipv4_address, private_ip_as_int 
| limit 1 
```

**Explanation**: The private IP address "10.0.0.5" is successfully converted to its corresponding integer value 167772165.

**Output**:

| EVENT\_ID | IPV4\_ADDRESS | PRIVATE\_IP\_AS\_INT |
| --------- | ------------- | -------------------- |
| 102       | 10.0.0.5      | 167772165            |

### Example 5: Converting a public IPv4 address

**Goal**: Target a specific public IPv4 address from the dataset to demonstrate its conversion.

**XQL code**:

```sql
config timeframe = 1d 
| dataset = sample_xql_raw 
| filter event_id = 106 // Selects event with a public IP: 203.0.113.15 
| alter public_ip_as_int = ip_to_int(ipv4_address) // Converts the public IPv4 string to integer 
| fields event_id, ipv4_address, public_ip_as_int 
| limit 1 
```

**Explanation**: The public IP address "203.0.113.15" is successfully converted to its corresponding integer value 3407889679.

**Output**:

| EVENT\_ID | IPV4\_ADDRESS | PUBLIC\_IP\_AS\_INT |
| --------- | ------------- | ------------------- |
| 106       | 203.0.113.15  | 3407889679          |

## Related articles

* **Stages**: [`alter`](/xql-command-reference-guide/readme/stages/alter.md), [`config`](/xql-command-reference-guide/readme/stages/config.md), [`fields`](/xql-command-reference-guide/readme/stages/fields.md), [`filter`](/xql-command-reference-guide/readme/stages/filter.md), [`limit`](/xql-command-reference-guide/readme/stages/limit.md)
* **Functions**: [`int_to_ip`](/xql-command-reference-guide/readme/functions/int_to_ip.md)
* **Datasets**: [`xdr_data`](https://www.google.com/search?q=%5Bhttps://docs-cortex.paloaltonetworks.com/r/Cortex-XQL-Schema-Reference-Guide/Introduction%5D\(https://docs-cortex.paloaltonetworks.com/r/Cortex-XQL-Schema-Reference-Guide/Introduction\))


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/ip_to_int.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.