max_of

This page explains how to use the max_of function in APL.

Use the max_of function in APL (Axiom Processing Language) to return the maximum value from a list of scalar expressions. You can use it when you need to compute the maximum of a fixed set of values within each row, rather than across rows like with aggregation functions. It’s especially useful when the values you want to compare come from different columns or are dynamically calculated within the same row.

Use max_of when you want to:

• Compare multiple fields in a single event to determine the highest value.
• Perform element-wise maximum calculations in datasets where values are spread across columns.
• Evaluate conditional values and select the highest one on a per-row basis.
• Ensure a minimum value. For example, max_of(value, 0) always returns greater than 0.

For users of other query languages

If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.

Splunk SPL users

Splunk doesn’t provide a direct function equivalent to max_of. However, you can use the eval command with nested if statements or custom logic to emulate similar functionality on a per-event basis.

Splunk example

eval max_value=if(a > b and a > c, a, if(b > c, b, c))

extend max_value = max_of(a, b, c)

ANSI SQL users

ANSI SQL doesn’t offer a built-in function like max_of to compute the maximum across expressions in a single row. Instead, you typically use GREATEST, which serves a similar purpose.

SQL example

SELECT GREATEST(a, b, c) AS max_value FROM table

extend max_value = max_of(a, b, c)

Usage

Syntax

max_of(Expr1, Expr2, ..., ExprN)

Parameters

The function takes a comma-separated list of expressions to compare. All values must be of the same type.

Returns

The function returns the maximum value among the input expressions. The type of the result matches the type of the input expressions. All expressions must be of the same or compatible types.

Use case example

You have two data points for the size of HTTP responses: header size and body size. You want to find the maximum of these two values for each event.

Query

['sample-http-logs']
| extend max_size = max_of(resp_header_size_bytes, resp_body_size_bytes)
| project _time, id, resp_header_size_bytes, resp_body_size_bytes, max_size

Run in Playground

Output

_time	id	resp_header_size_bytes	resp_body_size_bytes	max_size
May 15, 11:18:53	4baad81e-2bca-408f-8a47-092065274037	39 B	2,805 B	2,805
May 15, 11:18:53	05b257c0-8f9d-4b23-8901-c5f288abc30b	24 B	988 B	988
May 15, 11:18:53	b34d937c-527a-4a05-b88f-5f3dba645de6	72 B	4,399 B	4,399
May 15, 11:18:53	12a623ec-8b0d-4149-a9eb-d3e18ad5b1cd	34 B	1,608 B	1,608
May 15, 11:18:53	d24f22a7-8748-4d3d-a815-ed93081fd5d1	84 B	4,080 B	4,080
May 15, 11:18:53	3cc68be1-bb9a-4199-bf75-62eef59e3a09	76 B	5,117 B	5,117
May 15, 11:18:53	abadabac-a6c0-4ff2-80a1-11143d7c408b	41 B	2,845 B	2,845