Axiom
Overview

series_magnitude

You can use series_magnitude when you need to measure the overall magnitude of a series, compare vector lengths, normalize data, or calculate distances in multi-dimensional space. This is particularly useful in signal processing, similarity analysis, and feature scaling for machine learning applications.

Usage#

Syntax#

series_magnitude(array)

Parameters#

Parameter Type Description
array dynamic A dynamic array of numeric values.

Returns#

A numeric scalar representing the Euclidean norm (magnitude) of the series, calculated as the square root of the sum of squared elements.

Use case examples#

In log analysis, you can use series_magnitude to calculate the overall load magnitude from multiple request duration measurements, creating a single metric representing total system stress.

Query

['sample-http-logs']
| summarize durations = make_list(req_duration_ms) by ['geo.city']
| extend load_magnitude = series_magnitude(durations)
| project ['geo.city'], load_magnitude
| order by load_magnitude desc

Run in Playground

Output

geo.city load_magnitude
Seattle 325.5 ms
Portland 285.2 ms
Denver 245.8 ms

This query calculates the magnitude of request duration vectors for each city, providing a single metric that represents the overall load intensity.

In OpenTelemetry traces, you can use series_magnitude to compute a composite performance metric that captures the overall latency footprint of each service.

Query

['otel-demo-traces']
| extend duration_ms = duration / 1ms
| summarize durations = make_list(duration_ms) by ['service.name']
| extend performance_magnitude = series_magnitude(durations)
| project ['service.name'], performance_magnitude
| order by performance_magnitude desc

Run in Playground

Output

service.name performance_magnitude
checkout 1250.5
frontend 895.3
cart 650.2

This query computes a magnitude metric for each service's latency profile, helping prioritize optimization efforts for services with the highest overall latency impact.

In security logs, you can use series_magnitude to calculate an overall threat intensity score based on multiple security metrics, creating a composite risk indicator.

Query

['sample-http-logs']
| summarize request_metrics = make_list(req_duration_ms) by status
| extend threat_magnitude = series_magnitude(request_metrics)
| project status, threat_magnitude
| order by threat_magnitude desc

Run in Playground

Output

status threat_magnitude
401 2850.5 ms
500 1250.3 ms
200 425.8 ms

This query calculates the magnitude of request patterns for each HTTP status code, providing a single metric that represents the overall intensity of potentially concerning traffic.

  • series_sum: Returns the sum of all values. Use when you need simple addition instead of Euclidean norm.
  • series_abs: Returns absolute values of elements. Often used before magnitude calculation to handle negative values.
  • series_pearson_correlation: Computes correlation between series. Use when measuring similarity instead of magnitude.
  • series_stats: Returns comprehensive statistics. Use when you need multiple measures instead of just magnitude.

Other query languages#

Splunk SPL users

In Splunk SPL, you would typically implement magnitude calculation manually using eval with square root and sum operations. In APL, series_magnitude provides this calculation as a built-in function.

Splunk example

... | eval squared_sum=pow(val1,2)+pow(val2,2)+pow(val3,2)
| eval magnitude=sqrt(squared_sum)

APL equivalent

datatable(values: dynamic)
[
  dynamic([3, 4, 5])
]
| extend magnitude = series_magnitude(values)
ANSI SQL users

In SQL, you would need to manually compute the magnitude using square root and sum of squares. In APL, series_magnitude provides this calculation in a single function for array data.

SQL example

SELECT SQRT(SUM(value * value)) AS magnitude
FROM measurements
GROUP BY group_id;

APL equivalent

datatable(values: dynamic)
[
  dynamic([3, 4, 5])
]
| extend magnitude = series_magnitude(values)

Updated

Was this page helpful?