lookup_ip_info ip: ipv4, [columnbinding: expression]+

Using a value or column of type IPv4, look up corresponding fields associated with the IP address.

The verb lookup_ip_info behaves similarly to the verb lookup, except rather than retrieving information from another dataset, it retrieves information from a virtual dataset called @ip_info. The currently available field in @ip_info is the JSON object column called geo. This column contains several fields.

The column geo contains the following fields:

Categories

• Join

Accelerable

lookup_ip_info is always accelerable if the input is accelerable. A dataset that only uses accelerable verbs can be accelerated, making queries on the dataset respond faster.

Examples

lookup_ip_info ipv4('127.0.0.1'), city:@ip_info.geo.city

Look up the city that the IP address '127.0.0.1' is located in and store it in a new column called "city".

lookup_ip_info ipv4('127.0.0.1'), timezone:@ip_info.geo.timezone, geolocation:@ip_info.geo

Using the IPv4 column "ip", look up the timezone of the IP address and a JSON object describing the aggregated geolocation information of the IP address, and store this information in new columns called "timezone" and "geolocation"