sign

sign is useful when you care about the direction of a value rather than its magnitude. For example, you can use sign to classify whether a request latency is above or below a baseline, detect whether a metric is trending up or down, or encode deviations as ternary labels for downstream classification.

Usage#

Syntax#

sign(x)

Parameters#

Name	Type	Required	Description
`x`	real	Yes	A real number.

Returns#

+1 if x is positive.
0 if x is zero.
-1 if x is negative.

Example#

Use sign to classify each request as faster (-1), on-target (0), or slower (+1) than a 200 ms baseline.

Query

['sample-http-logs']
| extend deviation = req_duration_ms - 200.0
| extend deviation_sign = sign(deviation)
| project _time, id, req_duration_ms, deviation_sign

Run in Playground

Output

_time	id	req_duration_ms	deviation_sign
2024-11-14 10:00:00	user-1	450.0	1
2024-11-14 10:01:00	user-2	80.0	-1
2024-11-14 10:02:00	user-3	200.0	0

abs: Returns the absolute value. Use it to get magnitude when direction from sign isn't enough.
round: Rounds a value. Use it to normalize values before comparing signs.
not: Reverses a boolean. Use it alongside sign for boolean-style conditions on direction.
pow: Raises a value to a power. Use pow(x, 2) together with sign(x) to keep direction while amplifying magnitude.
sqrt: Returns the square root. Use it to compute magnitude, and sign to determine direction, when you need a signed root.

Other query languages#

Splunk SPL users

Splunk SPL uses signum() rather than sign(). The semantics are identical: it returns +1, 0, or -1.

Splunk example

| eval direction = signum(deviation)

APL equivalent

['sample-http-logs']
| extend direction = sign(deviation)

ANSI SQL users

In ANSI SQL, SIGN() works the same as in APL: it returns +1, 0, or -1 for positive, zero, and negative inputs respectively.

SQL example

SELECT SIGN(deviation) AS direction FROM logs