The series_divide function performs element-wise division between two dynamic arrays (series) of numeric values. It divides corresponding elements from the first array by the corresponding elements in the second array and returns a new array containing the results. This function is useful when you need to calculate ratios, normalize data, or perform proportional analysis across time-series datasets.
You can use series_divide when you want to calculate rates, percentages, or ratios between different metrics. Common applications include calculating success rates, determining resource utilization ratios, computing performance improvements, and normalizing metrics for comparison across different scales.
For users of other query languages
If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.
In Splunk SPL, you typically use the eval command with the division operator to divide values. However, dividing arrays element-wise requires more complex operations. In APL, series_divide directly performs element-wise division on dynamic arrays.
datatable(x: dynamic, y: dynamic)
[
dynamic([10, 20, 30]), dynamic([2, 4, 5])
]
| extend ratio_series = series_divide(x, y)In SQL, you divide individual values using the / operator, but there's no built-in function for element-wise array division. You would need to unnest arrays and perform complex operations. In APL, series_divide handles this operation directly on dynamic arrays.
datatable(x: dynamic, y: dynamic)
[
dynamic([10, 20, 30]), dynamic([2, 4, 5])
]
| extend ratio_series = series_divide(x, y)Usage
Syntax
series_divide(array1, array2)Parameters
| Parameter | Type | Description |
|---|---|---|
array1 |
dynamic | The numerator dynamic array of numeric values. |
array2 |
dynamic | The denominator dynamic array of numeric values. |
Returns
A dynamic array where each element is the result of dividing the corresponding element from array1 by the corresponding element from array2. If the arrays have different lengths, the result array has the length of the shorter array. Division by zero returns infinity or negative infinity.
Use case examples
In log analysis, you can use series_divide to calculate success rates by dividing successful requests by total requests for each time period.
Query
['sample-http-logs']
| summarize successful_requests = make_list(iff(status == '200', 1, 0)), total_requests = make_list(1) by id
| extend success_rates = series_divide(successful_requests, total_requests)Output
| id | successful_requests | total_requests | success_rates |
|---|---|---|---|
| u123 | [1, 0, 1] | [1, 1, 1] | [1, 0, 1] |
| u456 | [1, 1] | [1, 1] | [1, 1] |
This query calculates success rates by dividing successful requests by total requests for each user.
In OpenTelemetry traces, you can use series_divide to calculate performance improvement ratios by comparing current span durations to baseline durations.
Query
['otel-demo-traces']
| summarize current_durations = make_list(duration / 1ms), baseline_durations = make_list(100.0) by ['service.name']
| extend performance_ratios = series_divide(current_durations, baseline_durations)Output
| service.name | current_durations | baseline_durations | performance_ratios |
|---|---|---|---|
| frontend | [80, 120, 90] | [100, 100, 100] | [0.8, 1.2, 0.9] |
| productcatalogservice | [50, 150] | [100, 100] | [0.5, 1.5] |
This query calculates performance ratios by dividing current span durations by baseline values for each service.
In security logs, you can use series_divide to calculate error rates by dividing error responses by total responses for different request types.
Query
['sample-http-logs']
| summarize error_requests = make_list(iff(status != '200', 1, 0)), total_requests = make_list(1) by method
| extend error_rates = series_divide(error_requests, total_requests)Output
| method | error_requests | total_requests | error_rates |
|---|---|---|---|
| GET | [0, 1, 0] | [1, 1, 1] | [0, 1, 0] |
| POST | [1, 0] | [1, 1] | [1, 0] |
This query calculates error rates by dividing error requests by total requests for each HTTP method.
List of related functions
- series_abs: Returns the absolute value of each element in an array. Use when you need to remove negative signs without rounding.
- series_add: Performs element-wise addition between two arrays. Use when you need to combine values instead of calculating ratios.
- series_cosine_similarity: Calculates cosine similarity between two arrays. Use when you need normalized similarity measures rather than raw dot products.
- series_dot_product: Calculates the dot product between two arrays. Use when you need the raw dot product value rather than normalized similarity.
- series_sum: Calculates the sum of all elements in a single array. Use when you need to sum elements within one array rather than computing dot products.