series_max

The series_max function compares two numeric arrays element by element and returns a new array. Each position in the result contains the maximum value between the corresponding elements from the two input arrays.

You use series_max when you want to create an envelope or upper bound from multiple series, combine baseline metrics with actual values, or merge data from different sources by keeping the higher value at each point. For example, you can compare response times across different servers and keep the higher value at each time point, or combine SLA thresholds with actual measurements.

Usage

Syntax

series_max(array1, array2)

Parameters

Returns

An array of numeric values. Each element is the maximum of the corresponding elements from array1 and array2.

Use case examples

['sample-http-logs']
| take 50
| make-series london_avg = avgif(req_duration_ms, ['geo.city'] == 'London'),
             paris_avg = avgif(req_duration_ms, ['geo.city'] == 'Paris')
             on _time step 1h
| extend max_duration = series_max(london_avg, paris_avg)

['sample-http-logs']
| take 50
| make-series success_count = countif(status == '200'),
             failure_count = countif(status != '200')
             on _time step 1h
| extend max_count = series_max(success_count, failure_count)

List of related functions

• series_min: Compares two arrays and returns the minimum value at each position.
• series_less: Compares two arrays and returns true where elements in the first array are less than the second.
• series_greater: Compares two arrays and returns true where the first array element is greater than the second.
• max: Aggregation function that returns the maximum value across grouped records.

Other query languages