Time series SPL-Simple Log Service(SLS)-阿里云帮助中心

What is a series?

A series is a two-dimensional data structure composed of a time dimension sequence and a metric dimension sequence, representing observations that change over time. The counterpart to a series is table data.

Comparison with the table model

Aspect	Table model	Series model
Data organization	Discrete time point records (row storage)	Continuous time series (column storage)
Query mode	Aggregation calculation based on discrete points	Supports time series operations such as sliding window
Storage efficiency	Suitable for low-frequency discrete events	Optimized for high-frequency continuous metric storage

Example

The following example calculates the average response time per minute by URI from NGINX access logs.

Table model

* 
| extend ts =  to_unixtime(date_trunc('hour',date_parse(time_local, '%d/%b/%Y:%H:%i:%s')))
| stats avg_latency = avg(cast(upstream_response_time as double)) by ts,request_uri

Discrete time point aggregation result:

Series model implementation

* 
| stats avg_latency=avg(cast(upstream_response_time as double)) by time_local, request_uri
| make-series avg_latency default = 'last'
    on time_local 
    from 'sls_begin_time' to 'sls_end_time' 
    step '1m' 
    by request_uri

Continuous time series visualization:

SPL instructions

SPL instructions convert tabular data into series data.

Instruction	Description
make-series	Transforms table data into a series.
render	Renders an SPL query result as a chart for visualization.

SPL functions

After data is converted into a series using , you can apply SPL functions for visualization.

Function	Description
second_to_nano	Converts timestamps from seconds to nanoseconds. Ideal for high-precision applications.
series_forecast	Predicts future trends from historical data. Use this function for monitoring, analysis, and planning.
series_pattern_anomalies	Uses machine learning to identify anomalies in a time series. Ideal for monitoring, alerting, and data analysis.
series_decompose_anomalies	Decomposes a time series into trend, seasonal, and residual components, and then analyzes the residual component with statistical methods to identify anomalies. Ideal for real-time monitoring, root cause analysis, and data quality detection.
series_drilldown	Performs a drill-down on a time series, enabling fine-grained analysis of a specific time period based on time-grouped statistics.
cluster	Performs quick group analysis on multiple time series or vector data to identify metric curves with similar shapes, detect abnormal patterns, or categorize data patterns.
series_describe	Analyzes a time series across multiple dimensions, including data continuity, data gaps, stability, periodicity, and significant trends.
correlation	Calculates the similarity between two objects. It can compare a vector with another vector or with a group of vectors, or return a similarity matrix for two groups of vectors.