> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/is_ipv6.md).

# is\_ipv6

Use the `is_ipv6()` function to determine if a string value represents a valid IPv6 address.

## Syntax

```sql
is_ipv6(<string>)

```

## Parameters

|  Name  |  Type  | Required | Description                                                                                                                                                                              |
| :----: | :----: | :------: | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| string | string |    Yes   | The string field or literal value to evaluate for IPv6 validity. The IPv6 address can be either an explicit string using quotes (for example, "2606:4700:4700::1111") or a string field. |

## Returns

The `is_ipv6()` function returns a boolean value: true if the string is a valid IPv6 address, and false otherwise.

## Usage Notes

* The function expects a string input and will return NULL if the input field is NULL or not present.
* Validation is strictly for IPv6 address formats. The function will return false for standard IPv4 addresses (for example, "1.1.1.1").
* This function is typically used within the `alter` stage to tag records, or within the `filter` stage to isolate specific IPv6 network traffic.

## Examples

### Example 1: Filter the IPv6 Addresses

**Goal**: Filter a dataset to evaluate an `ip` field and return only the records containing a valid IPv6 address.

**XQL Code**:

```sql
dataset = ips_test_raw
| alter IsIpv6 = is_ipv6(ip)
| filter IsIpv6
```

**Explanation**: You use the `is_ipv6()` function in the `alter` stage to check the `ip` field and assign the boolean result to a new field named `IsIpv6`. Next, you apply the `filter` stage to return only the rows where `IsIpv6` evaluates to true. While the original dataset contained IPv4 addresses like "1.1.1.1" and "192.168.1.100" (which evaluate to false), the filtered output retains only the valid IPv6 addresses "FF0E::1" and "2606:4700:4700::1111".

**Output**:

|         \_TIME         |          IP          | \_VENDOR | \_PRODUCT | ISIPV6 |
| :--------------------: | :------------------: | :------: | :-------: | :----: |
| Mar 26th 2025 19:26:07 |        FF0E::1       |    ips   |    test   |  true  |
| Mar 26th 2025 19:26:07 | 2606:4700:4700::1111 |    ips   |    test   |  true  |

## Related Articles

* **Stages**: [alter](/xql-command-reference-guide/readme/stages/alter.md), [filter](/xql-command-reference-guide/readme/stages/filter.md)
* **Functions**: [is\_ipv4()](/xql-command-reference-guide/readme/functions/is_ipv4.md), [is\_known\_private\_ipv4()](/xql-command-reference-guide/readme/functions/is_known_private_ipv4.md), [is\_known\_private\_ipv6()](/xql-command-reference-guide/readme/functions/is_known_private_ipv6.md), [incidr6()](/xql-command-reference-guide/readme/functions/incidr6.md)
* **Datasets**: [ips\_test\_raw](https://docs-cortex.paloaltonetworks.com/r/Cortex-XQL-Schema-Reference-Guide/Introduction)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/is_ipv6.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.