series_iir()

Applies to: ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel

Applies an Infinite Impulse Response filter on a series.

The function takes an expression containing dynamic numerical array as input, and applies an Infinite Impulse Response filter. By specifying the filter coefficients, you can use the function to:

• calculate the cumulative sum of the series
• apply smoothing operations
• apply various high-pass, band-pass, and low-pass filters

The function takes as input the column containing the dynamic array and two static dynamic arrays of the filter's denominators and numerators coefficients, and applies the filter on the column. It outputs a new dynamic array column, containing the filtered output.

Syntax

series_iir(series, numerators , denominators)

Learn more about syntax conventions.

Parameters

The filter's recursive formula

• Consider an input array X, and coefficients arrays a and b of lengths n_a and n_b respectively. The transfer function of the filter that will generate the output array Y, is defined by:

Example

Calculate a cumulative sum. Use the iir filter with coefficients denominators=[1,-1] and numerators=[1]:

let x = range(1.0, 10, 1);
print x=x, y = series_iir(x, dynamic([1]), dynamic([1,-1]))
| mv-expand x, y

Output

Here's how to wrap it in a function:

let vector_sum=(x: dynamic) {
    let y=array_length(x) - 1;
    todouble(series_iir(x, dynamic([1]), dynamic([1, -1]))[y])
};
print d=dynamic([0, 1, 2, 3, 4])
| extend dd=vector_sum(d)

Output