Functions

​

Quick reference: common function categories

​

Math-based functions

# Raw metric (instant vector)
node_cpu_seconds_total
# => {cpu="0", mode="idle"}   115.12
# => {cpu="0", mode="irq"}    87.4482
# Apply ceil()
ceil(node_cpu_seconds_total)
# => {cpu="0", mode="idle"}   116
# => {cpu="0", mode="irq"}    88
# Apply floor()
floor(node_cpu_seconds_total)
# => {cpu="0", mode="idle"}   115
# => {cpu="0", mode="irq"}    87
# Example using abs() with an arithmetic expression
# This computes the absolute value of (1 - sample).
abs(1 - node_cpu_seconds_total)
# => {cpu="0", mode="idle"}   114.12    # abs(1 - 115.12)
# => {cpu="0", mode="irq"}    86.4482   # abs(1 - 87.4482)
# => {cpu="0", mode="steal"}  43.245    # abs(1 - 44.245)

​

Date and time functions

• time() — current Unix time in seconds (float).
• minute(), hour(), day_of_week(), day_of_month(), days_in_month(), month(), year() — return the specified component of the current evaluation timestamp.

Expression         => result
---------------------------
minute()           => 07
hour()             => 15
day_of_week()      => 4
day_of_month()     => 22
days_in_month()    => 30
month()            => 09
year()             => 2022

​

Converting between scalars and vectors

• scalar(v) — Converts an instant vector v containing exactly one sample into a scalar value. If v contains more than one element, the result is NaN.
• vector(s) — Converts a scalar s into an instant vector containing a single sample (useful for combining scalar thresholds with vector operations).

​

Sorting

• sort(v) — ascending order.
• sort_desc(v) — descending order.

# Sorted ascending
sort(node_filesystem_avail_bytes)
# => node_filesystem_avail_bytes{device="gvfsd-fuse", fstype="fuse.gvfsd-fuse", instance="node1"} 0
# => node_filesystem_avail_bytes{device="tmpfs", fstype="tmpfs", instance="node1"} 5238784
# => node_filesystem_avail_bytes{device="/dev/sda2", fstype="vfat", instance="node1"} 531341312
# => node_filesystem_avail_bytes{device="tmpfs", fstype="tmpfs", instance="node1"} 725422080
# => node_filesystem_avail_bytes{device="tmpfs", fstype="tmpfs", instance="node1"} 726319104
# Sorted descending
sort_desc(node_filesystem_avail_bytes)
# => highest values first...

​

Presence checks: absent / present (and their _over_time variants)

• absent(v) — If v contains any elements, returns an empty vector. If no elements exist, returns a single-element vector with the value 1 and the labels taken from the expression.
• absent_over_time(v[range]) — Returns 1 for each series that has no samples inside the specified range; returns nothing if at least one sample exists.
• present_over_time(v[range]) — Returns 1 for each series that has at least one sample in the range; otherwise returns nothing for that series.

# If the series exists at least once in the given range:
present_over_time(node_filesystem_avail_bytes[5m])
# If the series has no samples in the range:
absent_over_time(node_memory_Active_bytes[1h])
# => {}

absent(nonexistent{job="myjob"})
absent(nonexistent{job="myjob", instance=".*"})
absent(sum(nonexistent{job="myjob"}))
# => {}

​

Counters and rate calculations

• rate(v[range]) — computes the average per-second rate of increase across the provided time range. It uses the first and last sample of the range (accounting for counter resets).
• irate(v[range]) — computes an instant rate using only the last two samples in the range (i.e., slope between the most recent samples).

• rate(http_errors[1m]) divides the series into overlapping 1-minute windows for each evaluation.
• If the scrape interval is 15s, each 1-minute window typically contains 4 samples.
• For each window, rate() computes (last_sample - first_sample) / window_seconds, yielding a per-second average across the window.

samples in window: 1.2, 2.3, 3.1, 3.3
first = 1.2, last = 3.3
difference = 3.3 - 1.2 = 2.1
rate = 2.1 / 60 = 0.035 (per second)

• irate(http_errors[1m]) still evaluates over the 1-minute range, but uses the last two samples within that window.
• Rate is (last - second_last) / time_difference_between_these_two_samples (often equal to the scrape interval, e.g., 15s).

# Instant rate using the last two samples in each window
irate(http_errors[1m])
# => calculated as (last - second_last) / scrape_interval_seconds

• Ensure the chosen range contains enough samples. With a 15s scrape interval, 1m yields ~4 samples; more samples improve stability.
• When aggregating across series, compute the rate first, then aggregate. This preserves correct counter-reset handling per series.

# Compute per-second rate per series first, then aggregate across series
sum without(code, handler) (rate(http_requests_total[24h]))

​

Example: network transmit bytes

# Per-second transmit rate averaged across a 1m window
rate(node_network_transmit_bytes_total[1m])

​

Summary and references

• PromQL offers many functions across categories: math, time/date, sorting, presence checks, conversions, and counter-rate computations.
• Use rate() for stable averages (preferred for alerting), and irate() for instant slopes (preferred for responsive graphs).
• Always compute rates per series before aggregation to properly handle resets.
• For a complete list and exact semantics, see the Prometheus docs: https://prometheus.io/docs/prometheus/latest/querying/functions/

• Prometheus Querying (official docs)