reverseip()

The reverseip() function reverses the octet order of an IPv4 address and returns the result as a string. It is primarily used to generate the reverse domain address required for DNS PTR record lookups.

Syntax

reverseip(IP)

Parameters

IP
A string in IPv4 address format, or a value of IP address type.

Description

The reverseip() function reverses the octet order of the input IPv4 address and returns the result as a string. For example, an input of 192.0.2.1 returns 1.2.0.192.

  • If IP is null, the function returns null.
  • If IP is not a valid IP address, the function returns null.
  • If the address is not an IPv4 address (for example, an IPv6 address), the function returns null.
  • Both string type and IP address type values are accepted as input.

Error codes

N/A

Usage examples

To prepare the WEB_APACHE_SAMPLE table used in these examples, refer to Preparing sample data.

  1. Reverse the source IP address

    table limit=5 WEB_APACHE_SAMPLE | eval result = reverseip(src_ip) | fields src_ip, result
| # result: a string with the octets of src_ip in reverse order

  2. Generate a reverse domain address for PTR record lookup

    table limit=5 WEB_APACHE_SAMPLE
| eval domain = concat(reverseip(src_ip), ".in-addr.arpa")
| fields src_ip, domain

  3. NULL input

    json "{'ip': null}" | eval result = reverseip(ip)
| # result: null

Compatibility

The reverseip() function is available since before Sonar 4.0.