This page explains how to use the ipv6_compare function in APL.
ipv6_compare
function to compare two IPv6 addresses and determine their relative order. This function helps you evaluate whether one address is less than, equal to, or greater than another. It returns -1
, 0
, or 1
accordingly.
You can use ipv6_compare
in scenarios where IPv6 addresses are relevant, such as sorting traffic logs, grouping metrics by address ranges, or identifying duplicate or misordered entries. It’s especially useful in network observability and security use cases where working with IPv6 is common.
Splunk SPL users
ANSI SQL users
Name | Type | Description |
---|---|---|
ipv6_1 | string | The first IPv6 address to compare. |
ipv6_2 | string | The second IPv6 address to compare. |
-1
if ipv6_1
is less than ipv6_2
0
if ipv6_1
is equal to ipv6_2
1
if ipv6_1
is greater than ipv6_2
ipv6_compare
to identify whether requests from certain IPv6 addresses fall into specific ranges or appear out of expected order.
Query
_time | uri | method | status | comparison |
---|---|---|---|---|
2025-06-29T22:10:00Z | /products/1 | GET | 200 | -1 |
ipv6_compare
but for IPv4 addresses. Use it when your data contains IPv4 instead of IPv6.