Is there a way in kql to convert a public IP address to a country? Basically I'm looking for the equivalent to Splunks iplocation function from SPL. Thanks.
1 Answers
Kusto is a platform and does not hold its own dataset for ip->geo mapping. Given you bring your own dataset - you can use ipv4/ipv6 functions to build such lookup.
https://docs.microsoft.com/en-us/azure/data-explorer/kusto/query/scalarfunctions#ipv4ipv6-functions
Related