The series_cos function returns the cosine of each element in a numeric array. You can use it to apply trigonometric transformations across entire time series or vectorized data in one step. This function is useful when you want to analyze periodic patterns, normalize angles, or apply mathematical transformations to series data such as request durations, response times, or trace latencies. You often use series_cos together with other series functions like series_sin and series_tan to perform mathematical modeling, anomaly detection, or seasonality analysis in logs and telemetry data.

For users of other query languages

If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.
In Splunk SPL, trigonometric functions like cos operate on single field values, not on arrays. To compute cosine across multiple values, you typically expand the values into events and then apply the eval cos(field) transformation. In APL, series_cos works natively on dynamic arrays, so you can directly transform an entire series in one call.
... | eval cos_val=cos(angle)
ANSI SQL does not provide direct support for array-wide trigonometric functions. The COS() function only works on single numeric values. To achieve array-like functionality, you usually need to unnest arrays and apply COS() row by row. In APL, series_cos eliminates this need by directly accepting an array and returning a transformed array.
SELECT COS(angle) AS cos_val
FROM Angles;

Usage

Syntax

series_cos(array)

Parameters

ParameterTypeDescription
arraydynamic (array of numbers)An array of numeric values.

Returns

A dynamic array where each element is the cosine of the corresponding input element.

Use case examples

You want to model periodic patterns in request durations by applying the cosine function to the values. This is useful if you want to normalize cyclical metrics for further analysis.Query
['sample-http-logs']
| summarize durations=make_list(req_duration_ms) by id
| extend cos_durations=series_cos(durations)
Run in PlaygroundOutput
iddurationscos_durations
u1[120, 300, 450][0.814, -0.990, -0.737]
u2[50, 250, 400][0.965, -0.801, -0.966]
This query collects request durations per user ID and applies the cosine transformation to the entire array.
  • series_abs: Returns the absolute value of each element in an array. Use it to normalize negative values in arrays.
  • series_acos: Computes the arccosine of each element in an array. Use when you want the inverse cosine.
  • series_atan: Computes the arctangent of each element in an array. Use when you want the inverse tangent.
  • series_sin: Returns the sine of each element in an array. Use it when analyzing cyclical data with a phase shift.
  • series_tan: Returns the tangent of each element in an array. Use it when you want to transform arrays with tangent-based periodicity.