The series_pow function raises each element in a numeric dynamic array (series) to a specified power. This performs element-wise exponentiation across the entire series.
You can use series_pow when you need to apply power transformations to time-series data. This is particularly useful for non-linear data transformations, calculating exponential growth patterns, applying polynomial features in analysis, or emphasizing larger values in your data.
For users of other query languages
If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.
In Splunk SPL, you typically use the pow() function within an eval command to calculate powers. In APL, series_pow applies the power operation to every element in an array simultaneously.
datatable(x: dynamic)
[
dynamic([2, 3, 4, 5])
]
| extend squared = series_pow(x, 2)In SQL, you use the POWER() function to raise values to a power on individual rows. In APL, series_pow operates on entire arrays, applying the exponentiation operation element-wise.
datatable(x: dynamic)
[
dynamic([2, 3, 4, 5])
]
| extend squared = series_pow(x, 2)Usage
Syntax
series_pow(array, power)Parameters
| Parameter | Type | Description |
|---|---|---|
array |
dynamic | A dynamic array of numeric values (base). |
power |
real | The exponent to which to raise each element. |
Returns
A dynamic array where each element is the result of raising the corresponding input element to the specified power.
Use case examples
In log analysis, you can use series_pow to emphasize outliers by squaring request durations, making larger values more prominent in analysis.
Query
['sample-http-logs']
| summarize durations = make_list(req_duration_ms) by id
| extend squared_durations = series_pow(durations, 2)
| take 5Output
| id | durations | squared_durations |
|---|---|---|
| u123 | [50, 100, 75, 200] | [2500, 10000, 5625, 40000] |
| u456 | [30, 45, 60, 90] | [900, 2025, 3600, 8100] |
This query squares request durations to amplify the differences, making performance anomalies more visible for analysis.
In OpenTelemetry traces, you can use series_pow to calculate exponential penalty scores based on span durations, emphasizing longer spans.
Query
['otel-demo-traces']
| extend duration_ms = duration / 1ms
| summarize durations = make_list(duration_ms) by ['service.name']
| extend penalty_score = series_pow(durations, 1.5)
| take 5Output
| service.name | durations | penalty_score |
|---|---|---|
| frontend | [100, 200, 150, 250] | [1000, 2828, 1837, 3952] |
| checkout | [50, 75, 60, 100] | [353, 649, 464, 1000] |
This query applies a power transformation to span durations, creating a penalty score that disproportionately penalizes longer spans.
In security logs, you can use series_pow to calculate non-linear risk scores based on request counts, where higher volumes represent exponentially greater risk.
Query
['sample-http-logs']
| summarize request_counts = make_list(req_duration_ms) by status
| extend risk_factor = series_pow(request_counts, 1.8)
| take 5Output
| status | request_counts | risk_factor |
|---|---|---|
| 200 | [50, 60, 55, 58] | [1767, 2601, 2121, 2419] |
| 401 | [100, 120, 110, 115] | [6309, 8710, 7328, 7926] |
This query applies an exponential transformation to request counts, creating risk scores where high-volume patterns receive disproportionately higher scores.
List of related functions
- series_multiply: Performs element-wise multiplication of two series. Use when you need multiplication between two series instead of raising to a power.
- series_log: Computes the natural logarithm of each element. Use as the inverse operation to exponentials.
- series_abs: Returns the absolute value of each element. Use when you need magnitude without power transformations.
- series_sign: Returns the sign of each element. Useful before applying power operations to handle negative values.