Axiom
Overview

series_fir

You can use series_fir when you want to apply signal processing techniques to your time series data, such as smoothing noisy data, removing high-frequency noise, or implementing custom filtering operations. This is particularly useful for preprocessing data before analysis, removing artifacts, or extracting specific frequency components. Typical applications include sensor data processing, financial time series analysis, and performance monitoring where noise reduction is important.

Usage#

Syntax#

series_fir(array, kernel)

Parameters#

Parameter Type Description
array dynamic A dynamic array of numeric values representing the input signal.
kernel dynamic A dynamic array of numeric values representing the FIR filter coefficients.

Returns#

A dynamic array representing the filtered signal after applying the FIR filter.

Use case examples#

In log analysis, you can use series_fir to smooth noisy request duration data using a moving average filter, which helps identify underlying performance trends.

Query

['sample-http-logs']
| summarize durations = make_list(req_duration_ms) by id
| extend smoothed_durations = series_fir(durations, dynamic([0.2, 0.2, 0.2, 0.2, 0.2]))

Run in Playground

Output

id durations smoothed_durations
u123 [100, 120, 110, 130, 105] [100, 110, 110, 115, 115]
u456 [150, 140, 160, 135, 145] [150, 145, 150, 147.5, 144]

This query applies a 5-point moving average filter to request durations, useful for smoothing out noise and identifying underlying performance trends.

In OpenTelemetry traces, you can use series_fir to smooth noisy span duration data using a low-pass filter, which helps identify consistent latency patterns.

Query

['otel-demo-traces']
| summarize durations = make_list(duration) by ['service.name']
| extend smoothed_durations = series_fir(durations, dynamic([0.25, 0.25, 0.25, 0.25]))

Run in Playground

Output

service.name durations smoothed_durations
frontend [100ms, 120ms, 110ms, 130ms] [100ms, 110ms, 110ms, 115ms]
product-catalog [50ms, 60ms, 55ms, 65ms] [50ms, 55ms, 55ms, 60ms]

This query applies a 4-point moving average filter to span durations, useful for smoothing out noise and identifying consistent latency patterns across services.

In security logs, you can use series_fir to smooth noisy request duration data using a high-pass filter to detect anomalies while removing baseline noise.

Query

['sample-http-logs']
| summarize durations = make_list(req_duration_ms) by status
| extend filtered_durations = series_fir(durations, dynamic([-0.1, -0.1, 0.4, -0.1, -0.1]))

Run in Playground

Output

status durations filtered_durations
200 [100, 120, 110, 130, 105] [-2, 2, 4, 2, -2]
500 [200, 220, 210, 230, 205] [-2, 2, 4, 2, -2]

This query applies a high-pass filter to request durations grouped by status code, useful for detecting anomalies while removing baseline noise in security analysis.

  • series_fft: Performs Fast Fourier Transform on a series. Use for frequency domain analysis before applying filters.
  • series_ifft: Performs inverse FFT to convert frequency domain back to time domain. Use after frequency domain filtering.
  • series_fill_linear: Fills missing values using linear interpolation. Use for data preprocessing before filtering.
  • series_abs: Returns the absolute value of each element in an array. Use for analyzing filter output magnitudes.
  • series_cos: Returns the cosine of each element in an array. Use for generating filter kernels or analyzing periodic components.

Other query languages#

Splunk SPL users

In Splunk SPL, FIR filtering isn’t natively available and typically requires external tools or complex workarounds using statistical functions like movingavg or streamstats. Most Splunk users rely on simple moving averages for smoothing. In APL, series_fir provides direct access to sophisticated digital signal processing capabilities with custom filter kernels.

Splunk example

... | streamstats window=5 current=f avg(field) as smoothed_field

APL equivalent

datatable(values: dynamic)
[
  dynamic([100, 120, 110, 130, 105])
]
| extend filtered_values = series_fir(values, dynamic([0.2, 0.2, 0.2, 0.2, 0.2]))
ANSI SQL users

ANSI SQL does not provide FIR filtering functionality. Database systems typically require specialized extensions or external libraries for digital signal processing. Most SQL users rely on window functions with simple averages for smoothing. In APL, series_fir brings advanced signal processing capabilities directly into the query language.

SQL example

SELECT AVG(value) OVER (ORDER BY timestamp ROWS BETWEEN 2 PRECEDING AND 2 FOLLOWING) AS smoothed_value
FROM measurements;

APL equivalent

datatable(values: dynamic)
[
  dynamic([100, 120, 110, 130, 105])
]
| extend filtered_values = series_fir(values, dynamic([0.2, 0.2, 0.2, 0.2, 0.2]))

Updated

Was this page helpful?