series_dot_product
You can use series_dot_product when you need to measure the similarity between two datasets, calculate weighted sums, perform correlation analysis, or compute projections in multidimensional analysis. Common applications include recommendation systems, signal processing, pattern recognition, and statistical analysis of performance metrics.
Usage#
Syntax#
series_dot_product(array1, array2)Parameters#
| Parameter | Type | Description |
|---|---|---|
array1 |
dynamic | The first dynamic array of numeric values. |
array2 |
dynamic | The second dynamic array of numeric values. |
Returns#
A real value representing the dot product of the two arrays. If the arrays have different lengths, only elements up to the length of the shorter array are used in the calculation.
Use case examples#
In log analysis, you can use series_dot_product to calculate weighted similarity scores between user request patterns, where weights represent the importance of different time periods.
Query
['sample-http-logs']
| summarize request_counts = make_list(1), importance_weights = make_list(req_duration_ms / 100.0) by id
| extend weighted_score = series_dot_product(request_counts, importance_weights)Output
| id | request_counts | importance_weights | weighted_score |
|---|---|---|---|
| u123 | [1, 1, 1] | [1.2, 3.4, 0.8] | 5.4 |
| u456 | [1, 1] | [2.1, 1.5] | 3.6 |
This query calculates weighted activity scores by computing the dot product of request counts and duration-based importance weights.
In OpenTelemetry traces, you can use series_dot_product to calculate correlation scores between span durations and error rates across different services.
Query
['otel-demo-traces']
| summarize durations = make_list(duration / 1ms), error_indicators = make_list(iff(status_code != '200', 1.0, 0.0)) by ['service.name']
| extend correlation_score = series_dot_product(durations, error_indicators)Output
| service.name | durations | error_indicators | correlation_score |
|---|---|---|---|
| frontend | [200, 150, 300] | [0, 1, 0] | 150 |
| productcatalogservice | [80, 120] | [1, 0] | 80 |
This query calculates correlation scores between span durations and error occurrences to identify performance-error relationships.
In security logs, you can use series_dot_product to calculate risk scores by combining request frequencies with security threat levels.
Query
['sample-http-logs']
| summarize request_frequencies = make_list(1), threat_levels = make_list(iff(status == '401', 3.0, iff(status == '403', 2.0, 1.0))) by ['geo.country']
| extend risk_score = series_dot_product(request_frequencies, threat_levels)Output
| geo.country | request_frequencies | threat_levels | risk_score |
|---|---|---|---|
| US | [1, 1, 1] | [1, 3, 1] | 5 |
| UK | [1, 1] | [2, 1] | 3 |
This query calculates security risk scores by computing the dot product of request frequencies and threat levels by country.
List of related functions#
- series_abs: Returns the absolute value of each element in an array. Use when you need to remove negative signs without rounding.
- series_add: Performs element-wise addition between two arrays. Use when you need to combine values instead of calculating ratios.
- series_cosine_similarity: Calculates cosine similarity between two arrays. Use when you need normalized similarity measures rather than raw dot products.
- series_divide: Performs element-wise division between two arrays. Use when you need to calculate ratios or normalize values.
- series_sum: Calculates the sum of all elements in a single array. Use when you need to sum elements within one array rather than computing dot products.
Other query languages#
Splunk SPL users
In Splunk SPL, calculating dot products requires complex operations using eval commands with array manipulation and mathematical functions. In APL, series_dot_product provides this calculation directly for dynamic arrays.
Splunk example
... | eval products = mvzip(array1, array2, "*") | eval dot_product = mvsum(products)APL equivalent
datatable(x: dynamic, y: dynamic)
[
dynamic([1, 2, 3]), dynamic([4, 5, 6])
]
| extend dot_product = series_dot_product(x, y)ANSI SQL users
In SQL, calculating dot products requires joining arrays, multiplying corresponding elements, and summing the results. This typically involves complex window functions and mathematical operations. In APL, series_dot_product handles this calculation directly on dynamic arrays.
SQL example
SELECT SUM(a.value * b.value) AS dot_product
FROM array_a a
JOIN array_b b ON a.index = b.index;APL equivalent
datatable(x: dynamic, y: dynamic)
[
dynamic([1, 2, 3]), dynamic([4, 5, 6])
]
| extend dot_product = series_dot_product(x, y)