series_iir()

Applies to: ✅ Microsoft Fabric ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel

Applies an Infinite Impulse Response filter on a series.

The function takes an expression containing dynamic numerical array as input, and applies an Infinite Impulse Response filter. By specifying the filter coefficients, you can use the function to:

• calculate the cumulative sum of the series
• apply smoothing operations
• apply various high-pass, band-pass, and low-pass filters

The function takes as input the column containing the dynamic array and two static dynamic arrays of the filter's denominators and numerators coefficients, and applies the filter on the column. It outputs a new dynamic array column, containing the filtered output.

Syntax

series_iir(series, numerators , denominators)

Learn more about syntax conventions.

Parameters

Name	Type	Required	Description
series	dynamic	✔️	An array of numeric values, typically the resulting output of make-series or make_list operators.
numerators	dynamic	✔️	An array of numeric values, containing the numerator coefficients of the filter.
denominators	dynamic	✔️	An array of numeric values, containing the denominator coefficients of the filter.

Important

The first element of a (that is, a[0]) mustn't be zero, to avoid division by 0. See the following formula.

The filter's recursive formula

• Consider an input array X, and coefficients arrays a and b of lengths n_a and n_b respectively. The transfer function of the filter that will generate the output array Y, is defined by:

Y_i = a₀^-1(b₀X_i + b₁X_i-1 + ... + b_nb-1X_i-nb-1 - a₁Y_i-1-a₂Y_i-2 - ... - a_na-1Y_i-na-1)

Example

Calculate a cumulative sum. Use the iir filter with coefficients denominators=[1,-1] and numerators=[1]:

Run the query

let x = range(1.0, 10, 1);
print x=x, y = series_iir(x, dynamic([1]), dynamic([1,-1]))
| mv-expand x, y

Output

x	y
1.0	1.0
2.0	3.0
3.0	6.0
4.0	10.0

Here's how to wrap it in a function:

Run the query

let vector_sum=(x: dynamic) {
    let y=array_length(x) - 1;
    todouble(series_iir(x, dynamic([1]), dynamic([1, -1]))[y])
};
print d=dynamic([0, 1, 2, 3, 4])
| extend dd=vector_sum(d)

Output

d	dd
[0,1,2,3,4]	10