Skip to main content
Use the abs function in APL to compute the absolute value of a numeric expression or timespan. The function removes the sign from the input, so it always returns a non-negative result. abs is useful whenever you care about the magnitude of a deviation rather than its direction. For example, you can use it to measure how far a request latency strays from a baseline, or how large a fluctuation in a metric is regardless of whether it’s above or below the expected value.

​
For users of other query languages

If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.
In Splunk SPL, the abs() function works identically: it takes a single numeric argument and returns its absolute value.
| eval deviation = abs(req_duration_ms - 100)
In ANSI SQL, ABS() is a standard built-in function with the same semantics as in APL.
SELECT ABS(req_duration_ms - 100) AS deviation FROM logs

​
Usage

​
Syntax

abs(x)

​
Parameters

NameTypeRequiredDescription
xint, real, or timespanYesThe value to compute the absolute value of.

​
Returns

The absolute value of x. The return type matches the input type.

​
Example

Use abs to find how far each request’s duration deviates from a 200 ms baseline. Query 
['sample-http-logs']
| extend deviation = abs(req_duration_ms - 200)
| project _time, id, req_duration_ms, deviation
| order by deviation desc
Run in Playground Output
_timeidreq_duration_msdeviation
2024-11-14 10:00:00user-1450.0250.0
2024-11-14 10:01:00user-280.0120.0
2024-11-14 10:02:00user-3205.05.0
  • round: Rounds a value to a specified number of decimal places. Use it when you want to reduce precision rather than compute magnitude.
  • sign: Returns the sign of a numeric value (+1, 0, or -1). Use it when you want to know direction rather than magnitude.
  • sqrt: Returns the square root. Use it to compute the root-mean-square of deviations for standard deviation calculations.
  • pow: Raises a value to a power. Use it to square deviations when computing variance.
  • log: Returns the natural logarithm. Use it when you need to work on a logarithmic scale rather than with raw magnitudes.