Skip to main content
The series_magnitude function calculates the Euclidean norm (magnitude) of a numeric dynamic array (series). This computes the square root of the sum of squared elements, representing the length or magnitude of the vector. You can use series_magnitude when you need to measure the overall magnitude of a series, compare vector lengths, normalize data, or calculate distances in multi-dimensional space. This is particularly useful in signal processing, similarity analysis, and feature scaling for machine learning applications.

For users of other query languages

If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.
In Splunk SPL, you would typically implement magnitude calculation manually using eval with square root and sum operations. In APL, series_magnitude provides this calculation as a built-in function.
... | eval squared_sum=pow(val1,2)+pow(val2,2)+pow(val3,2)
| eval magnitude=sqrt(squared_sum)
In SQL, you would need to manually compute the magnitude using square root and sum of squares. In APL, series_magnitude provides this calculation in a single function for array data.
SELECT SQRT(SUM(value * value)) AS magnitude
FROM measurements
GROUP BY group_id;

Usage

Syntax

series_magnitude(array)

Parameters

ParameterTypeDescription
arraydynamicA dynamic array of numeric values.

Returns

A numeric scalar representing the Euclidean norm (magnitude) of the series, calculated as the square root of the sum of squared elements.

Use case examples

  • Log analysis
  • OpenTelemetry traces
  • Security logs
In log analysis, you can use series_magnitude to calculate the overall load magnitude from multiple request duration measurements, creating a single metric representing total system stress.Query
['sample-http-logs']
| summarize durations = make_list(req_duration_ms) by ['geo.city']
| extend load_magnitude = series_magnitude(durations)
| project ['geo.city'], load_magnitude
| order by load_magnitude desc
Run in PlaygroundOutput
geo.cityload_magnitude
Seattle325.5 ms
Portland285.2 ms
Denver245.8 ms
This query calculates the magnitude of request duration vectors for each city, providing a single metric that represents the overall load intensity.
  • series_sum: Returns the sum of all values. Use when you need simple addition instead of Euclidean norm.
  • series_abs: Returns absolute values of elements. Often used before magnitude calculation to handle negative values.
  • series_pearson_correlation: Computes correlation between series. Use when measuring similarity instead of magnitude.
  • series_stats: Returns comprehensive statistics. Use when you need multiple measures instead of just magnitude.