is_ipv6 ↗

Use the is_ipv6() function to determine if a string value represents a valid IPv6 address.

Syntax

is_ipv6(<string>)

Parameters

Name Type Required Description
string string Yes The string field or literal value to evaluate for IPv6 validity. The IPv6 address can be either an explicit string using quotes (for example, "2606:4700:4700::1111") or a string field.

Returns

The is_ipv6() function returns a boolean value: true if the string is a valid IPv6 address, and false otherwise.

Usage Notes

  • The function expects a string input and will return NULL if the input field is NULL or not present.
  • Validation is strictly for IPv6 address formats. The function will return false for standard IPv4 addresses (for example, "1.1.1.1").
  • This function is typically used within the alter stage to tag records, or within the filter stage to isolate specific IPv6 network traffic.

Examples

Example 1: Filter the IPv6 Addresses

Goal: Filter a dataset to evaluate an ip field and return only the records containing a valid IPv6 address.

XQL Code:

dataset = ips_test_raw
| alter IsIpv6 = is_ipv6(ip)
| filter IsIpv6

Explanation: You use the is_ipv6() function in the alter stage to check the ip field and assign the boolean result to a new field named IsIpv6. Next, you apply the filter stage to return only the rows where IsIpv6 evaluates to true. While the original dataset contained IPv4 addresses like "1.1.1.1" and "192.168.1.100" (which evaluate to false), the filtered output retains only the valid IPv6 addresses "FF0E::1" and "2606:4700:4700::1111".

Output:

_TIME IP _VENDOR _PRODUCT ISIPV6
Mar 26th 2025 19:26:07 FF0E::1 ips test true
Mar 26th 2025 19:26:07 2606:4700:4700::1111 ips test true