The series_fill_const function fills missing values (nulls) in a numeric dynamic array (series) with a specified constant value. This function is useful for handling gaps in time series data where you want to replace missing data points with a known default value.
You can use series_fill_const when you have time series data with missing values and want to fill gaps with a specific constant value, such as zero, a default threshold, or a neutral value. This is particularly useful when missing values represent a specific state (like no activity, default configuration, or baseline values). Typical applications include financial data analysis, sensor data processing, and performance monitoring where a specific default value is meaningful.
For users of other query languages
If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.
In Splunk SPL, filling missing values with constants is typically done with the fillnull command or eval expressions using conditional logic. To fill arrays with constants, you usually need to expand arrays and apply the transformation row by row. In APL, series_fill_const works directly on dynamic arrays, making it efficient for series-wide constant filling.
datatable(values: dynamic)
[
dynamic([null, 100, null, 200])
]
| extend filled_values = series_fill_const(values, 0)In SQL, filling missing values with constants is typically done with COALESCE() or ISNULL() functions, but these only work on single values, not arrays. To fill array elements with constants, you usually need to unnest arrays and apply the function row by row. In APL, series_fill_const eliminates this complexity by directly replacing null values with a constant in arrays.
datatable(values: dynamic)
[
dynamic([null, 100, null, 200])
]
| extend filled_values = series_fill_const(values, 0)Usage
Syntax
series_fill_const(array, constant_value)Parameters
| Parameter | Type | Description |
|---|---|---|
array |
dynamic | A dynamic array of numeric values that may contain null values. |
constant_value |
numeric | The constant value to use for filling null values. |
Returns
A dynamic array where null values are replaced with the specified constant value.
Use case examples
In log analysis, you can use series_fill_const to fill missing request duration data with a default value like 0, which might represent no activity or baseline performance.
Query
['sample-http-logs']
| summarize durations = make_list(req_duration_ms) by id
| extend filled_durations = series_fill_const(durations, 0)Output
| id | durations | filled_durations |
|---|---|---|
| u123 | [null, 150, null, 200] | [0, 150, 0, 200] |
| u456 | [100, null, null, 300] | [100, 0, 0, 300] |
This query fills missing request durations with 0, useful for representing periods of no activity or baseline performance.
In OpenTelemetry traces, you can use series_fill_const to fill missing span duration data with a default value, such as 0 for spans that didn't execute or a baseline latency value.
Query
['otel-demo-traces']
| summarize durations = make_list(duration) by ['service.name']
| extend filled_durations = series_fill_const(durations, 0)Output
| service.name | durations | filled_durations |
|---|---|---|
| frontend | [null, 100ms, null, 200ms] | [0ms, 100ms, 0ms, 200ms] |
| productcatalogservice | [50ms, null, null, 150ms] | [50ms, 0ms, 0ms, 150ms] |
This query fills missing span durations with 0ms, useful for representing spans that didn't execute or had no measurable duration.
In security logs, you can use series_fill_const to fill missing request duration data with a default value, such as 0 for blocked requests or a baseline value for analysis.
Query
['sample-http-logs']
| summarize durations = make_list(req_duration_ms) by status
| extend filled_durations = series_fill_const(durations, 0)Output
| status | durations | filled_durations |
|---|---|---|
| 200 | [null, 150, null, 250] | [0, 150, 0, 250] |
| 500 | [100, null, null, 400] | [100, 0, 0, 400] |
This query fills missing request durations with 0 grouped by status code, useful for representing blocked or failed requests with no measurable duration.
List of related functions
- series_fill_forward: Fills missing values by propagating the first known value forward. Use when you want to use the earliest available value to fill gaps.
- series_fill_backward: Fills missing values by propagating the last known value backward. Use when you want to use the most recent available value to fill gaps.
- series_fill_linear: Fills missing values using linear interpolation. Use when you want smooth transitions between known values.
- series_equals: Compares each element to a specified value. Use for identifying specific values after filling operations.
- series_greater: Returns elements greater than a specified value. Use for threshold analysis after filling missing data.