Skip to main content
The series_stats_dynamic function computes comprehensive statistical measures for a numeric dynamic array (series), returning results in a dynamic object format with named properties. This provides the same statistics as series_stats but with more convenient access through property names instead of array indices. You can use series_stats_dynamic when you need statistical summaries with easier property-based access, better code readability, or when integrating with other dynamic data structures. This is particularly useful in complex analytical workflows where referring to statistics by name (stats.min, stats.avg) is clearer than using array indices.

For users of other query languages

If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.
In Splunk SPL, you typically use multiple stats functions and store results as separate fields. In APL, series_stats_dynamic provides all statistics in a dynamic object that you can access by property names.
... | stats min(value) as min_val, max(value) as max_val, 
    avg(value) as avg_val, stdev(value) as stdev_val by user
In SQL, you calculate statistics separately and work with individual columns. In APL, series_stats_dynamic provides all statistics in a single dynamic object with named properties that you can query and transform.
SELECT 
    user_id,
    MIN(value) as min_val,
    MAX(value) as max_val,
    AVG(value) as avg_val,
    STDDEV(value) as std_val
FROM measurements
GROUP BY user_id;

Usage

Syntax

series_stats_dynamic(array)

Parameters

ParameterTypeDescription
arraydynamicA dynamic array of numeric values.

Returns

A dynamic object containing the following statistical properties:
PropertyDescription
minThe minimum value in the input array.
min_idxThe first position of the minimum value in the array.
maxThe maximum value in the input array.
max_idxThe first position of the maximum value in the array.
avgThe average value of the input array.
varianceThe sample variance of the input array.
stdevThe sample standard deviation of the input array.

Use case examples

  • Log analysis
  • Security logs
In log analysis, you can use series_stats_dynamic to generate comprehensive statistical reports with readable property names.Query
['sample-http-logs']
| summarize durations = make_list(req_duration_ms) by id
| extend stats = series_stats_dynamic(durations)
| extend performance_score = 100 - (stats.stdev / stats.avg * 100)
| project id, 
    min = stats.min,
    max = stats.max,
    avg = stats.avg,
    performance_score
| take 5
Run in PlaygroundOutput
idminmaxavgperformance_score
u123152459552.4
u45681897850.4
This query uses property names to access statistics and calculate a custom performance score based on the coefficient of variation.
  • series_stats: Returns the same statistics as a 7-element array instead of a dynamic object with named properties.
  • series_max: Compares two arrays element-wise and returns the maximum values.
  • series_min: Compares two arrays element-wise and returns the minimum values.
  • todynamic: Converts values to dynamic type for custom object construction.