Dec 10 2020 03:13 PM
Hey friends, I'm looking for some assistance on a Kusto query.
These are the datatables I am working with:
let TableOfNetworks = datatable(cidr:string)["67.171.12.0/22"];
let SigninTable = datatable(Username:string,IPAddress:string)
[
"Zach", "67.171.13.99",
"Tom", "192.68.1.1",
"Jerry", "127.0.0.1"
];
I have written a function that checks a single IPAddress against TableOfNetworks and returns the first match:
let ipMatchFunction = (ipCheck:string) {
TableOfNetworks
| where iff(ipCheck has ":",ipv6_is_match(ipCheck,cidr),ipv4_is_match(ipCheck,cidr))
| take 1
};
Now my requirement is to filter SigninTable to only show entries where ipMatchFunction(IPAddress) successfully finds a match. I want to do something like this but cannot figure out the correct syntax:
SigninTable
| where toscalar(ipMatchFunction(IPAddress)) != "";
//should show "Zach", "67.171.13.99"
Thanks for your help in advance! Hopefully I've made my problem clear.