abs

abs is useful whenever you care about the magnitude of a deviation rather than its direction. For example, you can use it to measure how far a request latency strays from a baseline, or how large a fluctuation in a metric is regardless of whether it's above or below the expected value.

Usage#

Syntax#

abs(x)

Parameters#

Name	Type	Required	Description
`x`	int, real, or timespan	Yes	The value to compute the absolute value of.

Returns#

The absolute value of x. The return type matches the input type.

Example#

Use abs to find how far each request's duration deviates from a 200 ms baseline.

Query

['sample-http-logs']
| extend deviation = abs(req_duration_ms - 200)
| project _time, id, req_duration_ms, deviation
| order by deviation desc

Run in Playground

Output

_time	id	req_duration_ms	deviation
2024-11-14 10:00:00	user-1	450.0	250.0
2024-11-14 10:01:00	user-2	80.0	120.0
2024-11-14 10:02:00	user-3	205.0	5.0

round: Rounds a value to a specified number of decimal places. Use it when you want to reduce precision rather than compute magnitude.
sign: Returns the sign of a numeric value (+1, 0, or -1). Use it when you want to know direction rather than magnitude.
sqrt: Returns the square root. Use it to compute the root-mean-square of deviations for standard deviation calculations.
pow: Raises a value to a power. Use it to square deviations when computing variance.
log: Returns the natural logarithm. Use it when you need to work on a logarithmic scale rather than with raw magnitudes.

Other query languages#

Splunk SPL users

In Splunk SPL, the abs() function works identically: it takes a single numeric argument and returns its absolute value.

Splunk example

| eval deviation = abs(req_duration_ms - 100)

APL equivalent

['sample-http-logs']
| extend deviation = abs(req_duration_ms - 100)

ANSI SQL users

In ANSI SQL, ABS() is a standard built-in function with the same semantics as in APL.

SQL example

SELECT ABS(req_duration_ms - 100) AS deviation FROM logs