The series_dot_product function calculates the dot product between two dynamic arrays (series) of numeric values. The dot product is computed by multiplying corresponding elements from both arrays and then summing all the products. This mathematical operation is fundamental in linear algebra and is useful for measuring similarity, calculating projections, and performing various analytical computations on time-series data.
You can use series_dot_product when you need to measure the similarity between two datasets, calculate weighted sums, perform correlation analysis, or compute projections in multidimensional analysis. Common applications include recommendation systems, signal processing, pattern recognition, and statistical analysis of performance metrics.
For users of other query languages
If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.
In Splunk SPL, calculating dot products requires complex operations using eval commands with array manipulation and mathematical functions. In APL, series_dot_product provides this calculation directly for dynamic arrays.
datatable(x: dynamic, y: dynamic)
[
dynamic([1, 2, 3]), dynamic([4, 5, 6])
]
| extend dot_product = series_dot_product(x, y)In SQL, calculating dot products requires joining arrays, multiplying corresponding elements, and summing the results. This typically involves complex window functions and mathematical operations. In APL, series_dot_product handles this calculation directly on dynamic arrays.
datatable(x: dynamic, y: dynamic)
[
dynamic([1, 2, 3]), dynamic([4, 5, 6])
]
| extend dot_product = series_dot_product(x, y)Usage
Syntax
series_dot_product(array1, array2)Parameters
| Parameter | Type | Description |
|---|---|---|
array1 |
dynamic | The first dynamic array of numeric values. |
array2 |
dynamic | The second dynamic array of numeric values. |
Returns
A real value representing the dot product of the two arrays. If the arrays have different lengths, only elements up to the length of the shorter array are used in the calculation.
Use case examples
In log analysis, you can use series_dot_product to calculate weighted similarity scores between user request patterns, where weights represent the importance of different time periods.
Query
['sample-http-logs']
| summarize request_counts = make_list(1), importance_weights = make_list(req_duration_ms / 100.0) by id
| extend weighted_score = series_dot_product(request_counts, importance_weights)Output
| id | request_counts | importance_weights | weighted_score |
|---|---|---|---|
| u123 | [1, 1, 1] | [1.2, 3.4, 0.8] | 5.4 |
| u456 | [1, 1] | [2.1, 1.5] | 3.6 |
This query calculates weighted activity scores by computing the dot product of request counts and duration-based importance weights.
In OpenTelemetry traces, you can use series_dot_product to calculate correlation scores between span durations and error rates across different services.
Query
['otel-demo-traces']
| summarize durations = make_list(duration / 1ms), error_indicators = make_list(iff(status_code != '200', 1.0, 0.0)) by ['service.name']
| extend correlation_score = series_dot_product(durations, error_indicators)Output
| service.name | durations | error_indicators | correlation_score |
|---|---|---|---|
| frontend | [200, 150, 300] | [0, 1, 0] | 150 |
| productcatalogservice | [80, 120] | [1, 0] | 80 |
This query calculates correlation scores between span durations and error occurrences to identify performance-error relationships.
In security logs, you can use series_dot_product to calculate risk scores by combining request frequencies with security threat levels.
Query
['sample-http-logs']
| summarize request_frequencies = make_list(1), threat_levels = make_list(iff(status == '401', 3.0, iff(status == '403', 2.0, 1.0))) by ['geo.country']
| extend risk_score = series_dot_product(request_frequencies, threat_levels)Output
| geo.country | request_frequencies | threat_levels | risk_score |
|---|---|---|---|
| US | [1, 1, 1] | [1, 3, 1] | 5 |
| UK | [1, 1] | [2, 1] | 3 |
This query calculates security risk scores by computing the dot product of request frequencies and threat levels by country.
List of related functions
- series_abs: Returns the absolute value of each element in an array. Use when you need to remove negative signs without rounding.
- series_add: Performs element-wise addition between two arrays. Use when you need to combine values instead of calculating ratios.
- series_cosine_similarity: Calculates cosine similarity between two arrays. Use when you need normalized similarity measures rather than raw dot products.
- series_divide: Performs element-wise division between two arrays. Use when you need to calculate ratios or normalize values.
- series_sum: Calculates the sum of all elements in a single array. Use when you need to sum elements within one array rather than computing dot products.