SPL函数

使用限制

• 已经通过make-series构造出series格式数据，并且时间单位为纳秒。

• 每行的时间点数量至少为31个 。

语法

series_forecast(array(T) field, bigint periods)

或

series_forecast(array(T) field, bigint periods, varchar params)

参数说明

返回值

row(
  time_series array(bigint),
  metric_series array(double),
  forecast_metric_series array(double),
  forecast_metric_upper_series array(double),
  forecast_metric_lower_series array(double),
  forecast_start_index bigint,
  forecast_length bigint,
  error_msg varchar)

示例

统计不同request_method接下来10个时间点的数量。

• SPL语句

  * | extend ts = second_to_nano(__time__ - __time__ % 60)
    | stats latency_avg = max(cast(status as double)), inflow_avg = min(cast (status as double)) by ts, request_method
    | make-series   latency_avg  default = 'last',
                  inflow_avg default = 'last'
                  on ts 
                  from 'min' to 'max'
                   step '1m' 
                  by request_method
   | extend test=series_forecast(inflow_avg, 10)

• 输出结果

  

算法参数

D        daily frequency
H        hourly frequency
T, min   minutely frequency
S        secondly frequency

使用限制

• 已经通过make-series构造出series格式数据，并且时间单位为纳秒。

• 每行的时间点数量至少为11个 。

语法

series_pattern_anomalies(array(T) metric_series)

参数说明

返回值

row(
  anomalies_score_series array(double),
  anomalies_type_series array(varchar)
  error_msg varchar)
) 

示例

检测当前时间点的序列是否有异常。

• SPL语句

  * | extend ts = second_to_nano(__time__ - __time__ % 60)
    | stats latency_avg = max(cast(status as double)), inflow_avg = min(cast (status as double)) by ts, request_method
    | where request_method is not null
    | make-series   latency_avg  default = 'last',
                  inflow_avg default = 'last'
                  on ts 
                  from 'min' to 'max'
                   step '1m' 
                  by request_method
   | extend test=series_pattern_anomalies(inflow_avg)

• 输出结果

  

使用限制

• 已经通过make-series构造出series格式数据，并且时间单位为纳秒。

• 每行的时间点数量至少为11个 。

语法

series_decompose_anomalies(array(T) metric_series)

或

series_decompose_anomalies(array(T) metric_series, varchar params)

参数说明

返回值

row(
  metric_baseline_series array(double)
  anomalies_score_series array(double),
  anomalies_type_series array(varchar)
  error_msg varchar)
) 

示例

对所有时间线异常检测之后，保留最近 5 min 异常分数值大于等于0的时间线。

• SPL语句

  * | extend ts = second_to_nano(__time__ - __time__ % 60)
    | stats latency_avg = max(cast(status as double)), inflow_avg = min(cast (status as double)) by ts, request_method
    | where request_method is not null
    | make-series   latency_avg  default = 'last',
                  inflow_avg default = 'last'
                  on ts 
                  from 'min' to 'max'
                   step '1m' 
                  by request_method
   | extend test=series_decompose_anomalies(inflow_avg, '{"confidence":"0.005"}')
   | extend anomalies_score_series = test.anomalies_score_series
   | where array_max(slice(anomalies_score_series, -5, 5)) >= 0

• 输出结果

  

算法参数

语法

series_drilldown(array(varchar) label_0_array,array(varchar) label_1_array,array(varchar) label_2_array, ... ,array(array(bigint)) time_series_array,array(array(double)) metric_series_array,bigint begin_time,bigint end_time)

或

series_drilldown(array(varchar) label_0_array,array(varchar) label_1_array,array(varchar) label_2_array, ... ,array(array(bigint)) time_series_array,array(array(double)) metric_series_array,bigint begin_time,bigint end_time,varchar config)

参数说明

返回值

row(dirlldown_result varchar, error_msg varchar)

示例

• SPL语句

  *
  | extend ts= (__time__- __time__%60)*1000000000
  | stats access_count = count(1) by ts, Method, ProjectName
  | extend access_count = cast( access_count as double)
  | make-series   access_count = access_count default = 'null'
                  on ts
                  from 'sls_begin_time' to 'sls_end_time'
                  step '1m'
                  by Method, ProjectName
  | stats m_arr = array_agg(Method), ProjectName = array_agg(ProjectName), ts_arr = array_agg(__ts__), metrics_arr = array_agg(access_count)
  | extend ret = series_drilldown(ARRAY['Method', 'Project'], m_arr, ProjectName, ts_arr, metrics_arr, 1739192700000000000, 1739193000000000000, '{"fill_na": "1", "gap_size": "3"}')
  | project ret

• 输出结果