IP and CIDR operators :: Kloudfuse Docs

IP and CIDR operators

FuseQL provides operators for working with IP addresses and CIDR notation, enabling network-level analysis of log data.

comparecidrprefix

Checks whether two IPv4 addresses share the same network prefix at a given CIDR prefix length. Returns true if both addresses fall within the same subnet, false otherwise. Use this to test whether a client IP belongs to a specific network range.

Syntax

| comparecidrprefix(<ipv4String1>, <ipv4String2>, <prefixLength>) as <alias>

Parameters

Parameter	Required	Description
`<ipv4String1>`	Yes	A string field or literal containing the first IPv4 address to compare.
`<ipv4String2>`	Yes	A string field or literal containing the second IPv4 address (typically the network base address).
`<prefixLength>`	Yes	An integer from 0 to 32 specifying the number of network bits to compare.
`as <alias>`	Yes	Name for the boolean output column.

Example

Check whether two IP addresses fall within the same /24 subnet.

source="nginx"
| compareCIDRPrefix("10.20.15.214", "10.20.15.1", 24) as same_net
| count by same_net

same_net	_count
True	198333

Expected output


	For example, `compareCIDRPrefix("10.20.15.214", "10.20.15.1", 24)` returns `true` because both addresses share the same `10.20.15.x` subnet. Narrower prefix lengths (larger number) require addresses to match more bits; `/32` requires an exact match. Use this operator to test subnet membership without computing explicit numeric ranges.

getcidrprefix

Returns the network address (prefix) for an IPv4 address given a CIDR prefix length. The host bits are zeroed out to produce the network identifier. Use this to group IP addresses by subnet for traffic analysis or access-control auditing.

Syntax

| getcidrprefix(<ipv4String>, <prefixLength>) as <alias>

Parameters

Parameter	Required	Description
`<ipv4String>`	Yes	A string field or literal containing a dot-decimal IPv4 address.
`<prefixLength>`	Yes	An integer from 0 to 32 specifying the number of network bits.
`as <alias>`	Yes	Name for the string output column.

Example

Return the /16 network prefix for a known IPv4 address.

source="nginx"
| getCIDRPrefix("10.20.15.214", 16) as subnet
| count by subnet

subnet	_count
10.20.0.0	205729

Expected output


	`getCIDRPrefix("10.20.15.214", 16)` returns `"10.20.0.0"` because a /16 mask zeroes out the last two octets. Adjust the prefix length to change granularity: use `/24` for individual host subnets or `/8` for broad network blocks. The prefix length must be between 0 and 32.

ipv4tonumber

Converts an IPv4 address from dot-decimal notation to its equivalent 32-bit unsigned decimal integer. This is useful for numeric range comparisons, sorting IPs arithmetically, and subnet boundary calculations without string manipulation.

Syntax

| ipv4tonumber(<ipv4String>) as <alias>

Parameters

Parameter	Required	Description
`<ipv4String>`	Yes	A string field or literal containing a dot-decimal IPv4 address.
`as <alias>`	Yes	Name for the numeric output column.

Example

Convert an IPv4 address to its 32-bit integer representation.

source="nginx"
| ipv4ToNumber("10.20.15.214") as ip_num
| min(ip_num) as min_ip, max(ip_num) as max_ip

min_ip	max_ip
169086934	169086934

Expected output


	The formula is: `(octet1 × 16,777,216) + (octet2 × 65,536) + (octet3 × 256) + octet4`. For example, `10.20.15.214` converts to `169,086,934`. Use the numeric result with range comparisons to test subnet membership, or sort IPs in numerical order rather than lexicographically.

isprivateip

Checks whether an IPv4 address falls within a private (RFC 1918) address range. Returns true for addresses in the 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 ranges, and false for all other addresses. Use this operator to identify internal service-to-service traffic in your logs.

Syntax

| isprivateip(<ipv4String>) as <alias>

Parameters

Parameter	Required	Description
`<ipv4String>`	Yes	A string field or literal containing an IPv4 address.
`as <alias>`	Yes	Name for the boolean output column.

Example

Check whether an nginx client IP falls within a private (RFC 1918) range.

source="nginx"
| isPrivateIP("10.20.15.214") as is_private
| count by is_private

is_private	_count
True	130532

Expected output


	`isprivateip` is the logical complement of `ispublicip`. In Kubernetes environments, most pod traffic originates from the 10.x.x.x private range, so most client IPs return `true`. Use `is_private=False` downstream to focus on external client traffic for security or geographic analysis.

ispublicip

Checks whether an IPv4 address is a public (routable) address. Returns false for addresses in RFC 1918 private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and other reserved ranges, and true for all other addresses. Use this operator to identify external traffic in logs.

Syntax

| ispublicip(<ipv4String>) as <alias>

Parameters

Example

Check whether a specific IP address is public (routable on the internet).

source="nginx"
| isPublicIP("8.8.8.8") as is_public
| count by is_public

is_public	_count
True	124365

Expected output


	`ispublicip` returns `false` for RFC 1918 private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and other reserved blocks. In Kubernetes environments, most client IPs in nginx access logs originate from the 10.x.x.x private range and return `false`. Use this operator to isolate external traffic for security auditing.

isvalidip

Checks whether an IPv4 or IPv6 address string is syntactically valid. Returns true if the address conforms to the correct format and falls within the allowed range, false otherwise. Useful for validating IP fields extracted from log lines before passing them to other IP operators.

Syntax

| isvalidip(<ipString>) as <alias>

Parameters

Parameter	Required	Description
`<ipString>`	Yes	A string field or literal containing an IPv4 or IPv6 address.
`as <alias>`	Yes	Name for the boolean output column.

Example

Check whether an extracted IPv4 address is syntactically valid.

source="nginx"
| isValidIP("10.20.15.214") as valid_ip
| count by valid_ip

valid_ip	_count
True	133504

Expected output


	`isvalidip` validates format only — it does not check whether the address is routable or reachable. Use it to guard against malformed IP fields before passing them to `ispublicip`, `isprivateip`, or `getcidrprefix`. Addresses with extra content such as ports (`"10.0.0.1:8080"`) return `false`.

maskfromcidr

Returns the IPv4 subnet mask string that corresponds to a given CIDR prefix length. The result is a dot-decimal string such as 255.255.255.0. Use this to display or compare subnet masks derived from CIDR notation.

Syntax

| maskfromcidr(<prefixLength>) as <alias>

Parameters

Parameter	Required	Description
`<prefixLength>`	Yes	An integer from 0 to 32 specifying the CIDR prefix length.
`as <alias>`	Yes	Name for the string output column.

Example

Compute the subnet mask for a /24 network and count log lines.

source="nginx"
| maskFromCIDR(24) as mask
| count

_count
203641

Expected output


	Common results: `maskFromCIDR(8)` → `"255.0.0.0"`, `maskFromCIDR(16)` → `"255.255.0.0"`, `maskFromCIDR(24)` → `"255.255.255.0"`, `maskFromCIDR(32)` → `"255.255.255.255"`. The prefix length must be between 0 and 32 inclusive. Use `maskfromcidr` to display the human-readable mask alongside a CIDR-grouped IP report.