series_cos
You often use series_cos together with other series functions like series_sin and series_tan to perform mathematical modeling, anomaly detection, or seasonality analysis in logs and telemetry data.
Usage#
Syntax#
series_cos(array)Parameters#
| Parameter | Type | Description |
|---|---|---|
array |
dynamic (array of numbers) | An array of numeric values. |
Returns#
A dynamic array where each element is the cosine of the corresponding input element.
Use case examples#
You want to model periodic patterns in request durations by applying the cosine function to the values. This is useful if you want to normalize cyclical metrics for further analysis.
Query
['sample-http-logs']
| summarize durations=make_list(req_duration_ms) by id
| extend cos_durations=series_cos(durations)Output
| id | durations | cos_durations |
|---|---|---|
| u1 | [120, 300, 450] | [0.814, -0.990, -0.737] |
| u2 | [50, 250, 400] | [0.965, -0.801, -0.966] |
This query collects request durations per user ID and applies the cosine transformation to the entire array.
You want to apply trigonometric transformations to span durations to explore cyclical behavior in distributed traces.
Query
['otel-demo-traces']
| summarize spans=make_list(duration) by ['service.name']
| extend cos_spans=series_cos(spans)Output
| service.name | spans | cos_spans |
|---|---|---|
| frontend | [00:00:01, 00:00:03] | [0.540, -0.990] |
| checkoutservice | [00:00:02, 00:00:04] | [-0.416, -0.653] |
This query groups spans by service and computes the cosine for each span duration, which can be used in advanced mathematical modeling of latency patterns.
You want to explore whether cosine transformations reveal patterns in request durations for suspicious traffic sources.
Query
['sample-http-logs']
| summarize durations=make_list(req_duration_ms) by ['geo.country']
| extend cos_blocked=series_cos(durations)Output
| geo.country | blocked_durations | cos_blocked |
|---|---|---|
| US | [200, 400, 600] | [-0.416, -0.653, 0.960] |
| DE | [100, 250, 500] | [0.540, -0.801, 0.284] |
This query applies the cosine function to blocked request durations grouped by country, which can help highlight periodic access attempts from malicious sources.
List of related functions#
- series_abs: Returns the absolute value of each element in an array. Use it to normalize negative values in arrays.
- series_acos: Computes the arccosine of each element in an array. Use when you want the inverse cosine.
- series_atan: Computes the arctangent of each element in an array. Use when you want the inverse tangent.
- series_sin: Returns the sine of each element in an array. Use it when analyzing cyclical data with a phase shift.
- series_tan: Returns the tangent of each element in an array. Use it when you want to transform arrays with tangent-based periodicity.
Other query languages#
Splunk SPL users
In Splunk SPL, trigonometric functions like cos operate on single field values, not on arrays. To compute cosine across multiple values, you typically expand the values into events and then apply the eval cos(field) transformation. In APL, series_cos works natively on dynamic arrays, so you can directly transform an entire series in one call.
Splunk example
... | eval cos_val=cos(angle)APL equivalent
print arr=dynamic([0, 1.57, 3.14])
| extend cos_arr=series_cos(arr)ANSI SQL users
ANSI SQL does not provide direct support for array-wide trigonometric functions. The COS() function only works on single numeric values. To achieve array-like functionality, you usually need to unnest arrays and apply COS() row by row. In APL, series_cos eliminates this need by directly accepting an array and returning a transformed array.
SQL example
SELECT COS(angle) AS cos_val
FROM Angles;APL equivalent
print arr=dynamic([0, 1.57, 3.14])
| extend cos_arr=series_cos(arr)