series_pow
You can use series_pow when you need to apply power transformations to time-series data. This is particularly useful for non-linear data transformations, calculating exponential growth patterns, applying polynomial features in analysis, or emphasizing larger values in your data.
Usage#
Syntax#
series_pow(array, power)Parameters#
| Parameter | Type | Description |
|---|---|---|
array |
dynamic | A dynamic array of numeric values (base). |
power |
real | The exponent to which to raise each element. |
Returns#
A dynamic array where each element is the result of raising the corresponding input element to the specified power.
Use case examples#
In log analysis, you can use series_pow to emphasize outliers by squaring request durations, making larger values more prominent in analysis.
Query
['sample-http-logs']
| summarize durations = make_list(req_duration_ms) by id
| extend squared_durations = series_pow(durations, 2)
| take 5Output
| id | durations | squared_durations |
|---|---|---|
| u123 | [50, 100, 75, 200] | [2500, 10000, 5625, 40000] |
| u456 | [30, 45, 60, 90] | [900, 2025, 3600, 8100] |
This query squares request durations to amplify the differences, making performance anomalies more visible for analysis.
In OpenTelemetry traces, you can use series_pow to calculate exponential penalty scores based on span durations, emphasizing longer spans.
Query
['otel-demo-traces']
| extend duration_ms = duration / 1ms
| summarize durations = make_list(duration_ms) by ['service.name']
| extend penalty_score = series_pow(durations, 1.5)
| take 5Output
| service.name | durations | penalty_score |
|---|---|---|
| frontend | [100, 200, 150, 250] | [1000, 2828, 1837, 3952] |
| checkout | [50, 75, 60, 100] | [353, 649, 464, 1000] |
This query applies a power transformation to span durations, creating a penalty score that disproportionately penalizes longer spans.
In security logs, you can use series_pow to calculate non-linear risk scores based on request counts, where higher volumes represent exponentially greater risk.
Query
['sample-http-logs']
| summarize request_counts = make_list(req_duration_ms) by status
| extend risk_factor = series_pow(request_counts, 1.8)
| take 5Output
| status | request_counts | risk_factor |
|---|---|---|
| 200 | [50, 60, 55, 58] | [1767, 2601, 2121, 2419] |
| 401 | [100, 120, 110, 115] | [6309, 8710, 7328, 7926] |
This query applies an exponential transformation to request counts, creating risk scores where high-volume patterns receive disproportionately higher scores.
List of related functions#
- series_multiply: Performs element-wise multiplication of two series. Use when you need multiplication between two series instead of raising to a power.
- series_log: Computes the natural logarithm of each element. Use as the inverse operation to exponentials.
- series_abs: Returns the absolute value of each element. Use when you need magnitude without power transformations.
- series_sign: Returns the sign of each element. Useful before applying power operations to handle negative values.
Other query languages#
Splunk SPL users
In Splunk SPL, you typically use the pow() function within an eval command to calculate powers. In APL, series_pow applies the power operation to every element in an array simultaneously.
Splunk example
... | eval squared=pow(value, 2)APL equivalent
datatable(x: dynamic)
[
dynamic([2, 3, 4, 5])
]
| extend squared = series_pow(x, 2)ANSI SQL users
In SQL, you use the POWER() function to raise values to a power on individual rows. In APL, series_pow operates on entire arrays, applying the exponentiation operation element-wise.
SQL example
SELECT POWER(value, 2) AS squared
FROM measurements;APL equivalent
datatable(x: dynamic)
[
dynamic([2, 3, 4, 5])
]
| extend squared = series_pow(x, 2)