Databricks makes native IP Functions generally available

Databricks made its native IP Functions generally available on Databricks Runtime 18.3 and above, the company announced on October 1. The built-in functions handle parsing, validation, normalization, filtering and joins for IPv4 and IPv6 addresses and CIDR blocks through SQL, PySpark and Scala.

For security, network-observability, threat-intelligence and fraud teams, the release provides a supported way to work with IP data inside the Lakehouse without maintaining custom user-defined functions, regular expressions or manual bitwise operations. Databricks says this can keep those workloads alongside other analytics under the same governance model; that consolidation benefit is a company claim, not an independently measured outcome. In a separate developer workflow, the company has also introduced Unity Gateway controls for coding agents.

CIDR notation represents a range of IP addresses with an address and prefix length, such as 10.0.0.0/8. Databricks’ function reference lists operations for canonical string and binary conversion, address and network extraction, prefix-length and IP-version inspection, and containment tests used in CIDR filtering and joins. Null-safe variants including try_ip_host and try_ip_as_binary return NULL for invalid input instead of failing a query, allowing raw logs to be screened before downstream processing.

Databricks says the functions are implemented in its engine and optimized in Photon so the query optimizer can accelerate IP range operations. In company-run benchmarks, Databricks said CIDR joins were up to 3.1 times faster and up to 6.4 times cheaper than an unnamed leading cloud data warehouse. The announcement does not identify the competitor or provide enough methodology to reproduce the comparison, and the opened evidence included no independent performance tests.

The functions predate the general-availability announcement. Databricks’ 2026 SQL release notes show them entering the Preview channel with SQL version 2026.20 on June 29. A version distinction remains unresolved: the October 1 announcement sets the GA boundary at Runtime 18.3 and above, while the function reference says the functions apply to Runtime 18.2 and above.