series_floor
You can use series_floor when you want to convert floating-point values to integers by rounding down, discretize continuous data into bins, or prepare data for categorical analysis. This is particularly useful for creating integer-based categories, implementing quantization schemes, or when you need to ensure values don’t exceed certain thresholds. Typical applications include data binning, performance categorization, and mathematical modeling where integer values are required.
Usage#
Syntax#
series_floor(array)Parameters#
| Parameter | Type | Description |
|---|---|---|
array |
dynamic | A dynamic array of numeric values. |
Returns#
A dynamic array where each element is the floor (largest integer less than or equal to) the corresponding input element.
Use case examples#
In log analysis, you can use series_floor to discretize request durations into integer bins for categorical analysis or performance categorization.
Query
['sample-http-logs']
| summarize durations = make_list(req_duration_ms) by id
| extend floor_durations = series_floor(durations)Output
| id | durations | floor_durations |
|---|---|---|
| u123 | [150.7, 200.3, 250.9] | [150, 200, 250] |
| u456 | [100.2, 300.8, 400.1] | [100, 300, 400] |
This query converts floating-point request durations to integers by rounding down, useful for creating discrete performance categories.
In OpenTelemetry traces, you can use series_floor to discretize span durations into integer milliseconds for consistent latency analysis.
Query
['otel-demo-traces']
| summarize durations = make_list(duration) by ['service.name']
| extend floor_durations = series_floor(durations)Output
| service.name | durations | floor_durations |
|---|---|---|
| frontend | [100.7ms, 200.3ms, 300.9ms] | [100ms, 200ms, 300ms] |
| product-catalog | [50.2ms, 150.8ms, 250.1ms] | [50ms, 150ms, 250ms] |
This query converts floating-point span durations to integer milliseconds by rounding down, useful for consistent latency categorization across services.
In security logs, you can use series_floor to discretize request durations into integer bins for security analysis and attack pattern detection.
Query
['sample-http-logs']
| summarize durations = make_list(req_duration_ms) by status
| extend floor_durations = series_floor(durations)Output
| status | durations | floor_durations |
|---|---|---|
| 200 | [150.7, 200.3, 250.9] | [150, 200, 250] |
| 500 | [100.2, 300.8, 400.1] | [100, 300, 400] |
This query converts floating-point request durations to integers by rounding down grouped by status code, useful for creating discrete performance categories in security analysis.
List of related functions#
- series_abs: Returns the absolute value of each element in an array. Use when you need to normalize values before applying floor operations.
- series_exp: Calculates the exponential of each element in an array. Use for exponential transformations instead of floor operations.
- series_cos: Returns the cosine of each element in an array. Use for trigonometric transformations instead of floor operations.
- series_sin: Returns the sine of each element in an array. Use for periodic transformations instead of floor operations.
- series_tan: Returns the tangent of each element in an array. Use for trigonometric transformations with different periodicity.
Other query languages#
Splunk SPL users
In Splunk SPL, floor operations are typically done with the eval function and the floor() expression. To compute floor across multiple values, you usually need to expand arrays and apply the transformation row by row. In APL, series_floor works directly on dynamic arrays, making it efficient for series-wide floor operations.
Splunk example
... | eval floor_val=floor(duration)APL equivalent
datatable(values: dynamic)
[
dynamic([3.7, 4.2, 5.9, 2.1])
]
| extend floor_values = series_floor(values)ANSI SQL users
In SQL, floor operations use the FLOOR() function, but this only works on single values, not arrays. To compute floor for array elements, you typically need to unnest arrays and apply FLOOR() row by row. In APL, series_floor eliminates this complexity by directly applying floor transformation to each element in an array.
SQL example
SELECT FLOOR(duration) AS floor_duration
FROM requests;APL equivalent
datatable(values: dynamic)
[
dynamic([3.7, 4.2, 5.9, 2.1])
]
| extend floor_values = series_floor(values)