Skip to main content
Use the sign function in APL to return the sign of a numeric expression: +1 for positive values, 0 for zero, and -1 for negative values. sign is useful when you care about the direction of a value rather than its magnitude. For example, you can use sign to classify whether a request latency is above or below a baseline, detect whether a metric is trending up or down, or encode deviations as ternary labels for downstream classification.

​
For users of other query languages

If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.
Splunk SPL uses signum() rather than sign(). The semantics are identical: it returns +1, 0, or -1.
| eval direction = signum(deviation)
In ANSI SQL, SIGN() works the same as in APL: it returns +1, 0, or -1 for positive, zero, and negative inputs respectively.
SELECT SIGN(deviation) AS direction FROM logs

​
Usage

​
Syntax

sign(x)

​
Parameters

NameTypeRequiredDescription
xrealYesA real number.

​
Returns

  • +1 if x is positive.
  • 0 if x is zero.
  • -1 if x is negative.

​
Example

Use sign to classify each request as faster (-1), on-target (0), or slower (+1) than a 200 ms baseline. Query 
['sample-http-logs']
| extend deviation = req_duration_ms - 200.0
| extend deviation_sign = sign(deviation)
| project _time, id, req_duration_ms, deviation_sign
Run in Playground Output
_timeidreq_duration_msdeviation_sign
2024-11-14 10:00:00user-1450.01
2024-11-14 10:01:00user-280.0-1
2024-11-14 10:02:00user-3200.00
  • abs: Returns the absolute value. Use it to get magnitude when direction from sign is not enough.
  • round: Rounds a value. Use it to normalize values before comparing signs.
  • not: Reverses a boolean. Use it alongside sign for boolean-style conditions on direction.
  • pow: Raises a value to a power. Use pow(x, 2) together with sign(x) to keep direction while amplifying magnitude.
  • sqrt: Returns the square root. Use it to compute magnitude, and sign to determine direction, when you need a signed root.