Document toolboxDocument toolbox

Is Public IPv4 (ispublic)

Description

You can apply this operation either as a Filter or Create field operation:

Filter

Returns only the public IP addresses of a selected ip field.

Create field

Creates a Boolean field that shows true if a given IP address is public.

Public addresses range from 1 to 191, excluding the following blocks, which are reserved as private:

  • 10.0.0.0 to 10.255.255.255

  • 172.16.0.0 to 172.31.255.255

  • 192.168.0.0 to 192.168.255.255

How does it work in the search window?

Select Filter / Create field in the search window toolbar, then select the Is Public IPv4 operation. You need to specify one argument:

Argument

Data type

Argument

Data type

IP to test mandatory

ip

If you use the Create field operation, the data type of the values in the new field is boolean (true or false).

Example

In the demo.ecommerce.data table, we want to get only the events where the IP addresses in the clientIpAddress field are public. To do it, we will apply a Filter using the Is public IPv4 operation.

The arguments needed for the filter are:

  • IP to test - clientIpAddress field

Click Filter data and you will see the following result:

To add a new Boolean field that shows true when the IP addresses in the clientIpAddress field are public, click Create field and follow the same steps.

How does it work in LINQ?

Use the operator where...  to apply the Filter operation and select... as...  to apply the Create field operation. This is the syntax for the Is Public IPv4 operation:

  • ispublic(ip)

Examples

You can copy the following LINQ script and try the above example on the demo.ecommerce.data table:

from demo.ecommerce.data where ispublic(clientIpAddress)

And this is the same example using the Create field operation:

from demo.ecommerce.data select ispublic(clientIpAddress) as public_ips