network()

The network() function takes an IPv4 or IPv6 address and a CIDR prefix length and returns the network address (starting address) of the corresponding network.

Syntax

Parameters

IP

The IPv4 or IPv6 address for which to calculate the network address. Accepts a string or IP address type.

CIDR

An integer representing the prefix length. Specify a value in the range 0–32 for IPv4, or 0–128 for IPv6. Accepts integer, long, and short types.

Description

The network() function applies a subnet mask corresponding to the CIDR prefix length to the IP address and returns the network address as a string. For example, applying a prefix length of 24 to 192.0.2.1 returns 192.0.2.0.

Both IPv4 and IPv6 are supported. Returns null if the CIDR value is out of the valid range or if CIDR is not an integer type. Returns null if IP or CIDR is null.

Error codes

N/A

Usage examples

To prepare the WEB_APACHE_SAMPLE table used in these examples, refer to Preparing sample data.

1. Extract the /24 network address from the source IP address.

   table limit=5 WEB_APACHE_SAMPLE | eval result = network(src_ip, 24)
   | fields src_ip, result
   

2. Extract the /16 network address from the source IP address.

   table limit=5 WEB_APACHE_SAMPLE | eval result = network(src_ip, 16)
   | fields src_ip, result
   

3. Extract the /96 network address from an IPv6 address.

   json "{}" | eval net = network("2001:db8::1:2:3", 96)
   | # net: 2001:db8:0:0:0:1:0:0
   

4. NULL input

   json "{}" | eval net = network(null, 24)
   | # net: null
   

Compatibility

The network() function has been available since before Sonar 4.0.