Add string_size, series_cos, series_sin, series_sum, series_tan

apl/apl-features.mdx

@@ -218,6 +218,7 @@ keywords: ['axiom documentation', 'documentation', 'axiom', 'APL', 'axiom proces
 | String function        | [strcat_delim](/apl/scalar-functions/string-functions#strcat-delim)                              | Concatenates 2–64 arguments with a delimiter. |
 | String function        | [strcat](/apl/scalar-functions/string-functions#strcat)                                          | Concatenates 1–64 arguments. |
 | String function        | [strcmp](/apl/scalar-functions/string-functions#strcmp)                                          | Compares two strings. |
+| String function        | [string-size](/apl/scalar-functions/string-functions/string-size)                                          | Returns the length, in characters, of the input string. |
 | String function        | [strlen](/apl/scalar-functions/string-functions#strlen)                                          | Returns the length of a string. |
 | String function        | [strrep](/apl/scalar-functions/string-functions#strrep)                                          | Repeats a string a given number of times. |
 | String function        | [substring](/apl/scalar-functions/string-functions#substring)                                    | Extracts a substring. |
@@ -298,11 +299,15 @@ keywords: ['axiom documentation', 'documentation', 'axiom', 'APL', 'axiom proces
 | Time series function          | [series_acos](/apl/scalar-functions/time-series/series-acos)                                        | Returns the inverse cosine (arccos) of a series. |
 | Time series function          | [series_asin](/apl/scalar-functions/time-series/series-asin)                                        | Returns the inverse sine (arcsin) of a series. |
 | Time series function          | [series_atan](/apl/scalar-functions/time-series/series-atan)                                        | Returns the inverse tangent (arctan) of a series. |
+| Time series function          | [series_cos](/apl/scalar-functions/time-series/series-cos)                                        | Returns the cosine of a series. |
 | Time series function          | [series_greater](/apl/scalar-functions/time-series/series-greater)                                        | Returns the elements of a series that are greater than a specified value. |
 | Time series function          | [series_greater_equals](/apl/scalar-functions/time-series/series-greater-equals)                                        | Returns the elements of a series that are greater than or equal to a specified value. |
 | Time series function          | [series_less](/apl/scalar-functions/time-series/series-less)                                        | Returns the elements of a series that are less than a specified value. |
 | Time series function          | [series_less_equals](/apl/scalar-functions/time-series/series-less-equals)                                        | Returns the elements of a series that are less than or equal to a specified value. |
 | Time series function          | [series_not_equals](/apl/scalar-functions/time-series/series-not-equals)                                        | Returns the elements of a series that aren’t equal to a specified value. |
+| Time series function          | [series_sin](/apl/scalar-functions/time-series/series-sin)                                        | Returns the sine of a series. |
+| Time series function          | [series_sum](/apl/scalar-functions/time-series/series-sum)                                        | Returns the sum of a series. |
+| Time series function          | [series_tan](/apl/scalar-functions/time-series/series-tan)                                        | Returns the tangent of a series. |
 | Type function          | [iscc](/apl/scalar-functions/type-functions/iscc)                                        | Checks whether a value is a valid credit card (CC) number. |
 | Type function          | [isimei](/apl/scalar-functions/type-functions/isimei)                                              | Checks whether a value is a valid International Mobile Equipment Identity (IMEI) number. |
 | Type function          | [ismap](/apl/scalar-functions/type-functions/ismap)                                              | Checks whether a value is of the `dynamic` type and represents a mapping. |

apl/scalar-functions/string-functions.mdx

@@ -41,6 +41,7 @@ The table summarizes the string functions available in APL.
 | [strcat_delim](#strcat-delim)                     | Concatenates between 2 and 64 arguments, with delimiter, provided as first argument.                                       |
 | [strcat](#strcat)                                 | Concatenates between 1 and 64 arguments.                                                                                   |
 | [strcmp](#strcmp)                                 | Compares two strings.                                                                                                      |
+| [string-size](/apl/scalar-functions/string-functions/string-size)                       | Returns the length, in characters, of the input string.                                                                    |
 | [strlen](#strlen)                                 | Returns the length, in characters, of the input string.                                                                    |
 | [strrep](#strrep)                                 | Repeats given string provided number of times (default = 1).                                                               |
 | [substring](#substring)                           | Extracts a substring from a source string.                                                                                 |

apl/scalar-functions/string-functions/string-size.mdx

@@ -0,0 +1,148 @@
+---
+title: string_size
+description: 'This page explains how to use the string_size function in APL.'
+---
+
+The `string_size` function returns the number of bytes in a string. You use it when you want to measure the length of text fields such as user IDs, URLs, or status codes. This function is useful for detecting anomalies, filtering out unusually long values, or analyzing patterns in textual data.
+
+For example, you can use `string_size` to detect requests with excessively long URIs, identify outlier user IDs, or monitor payload lengths in traces.
+
+## For users of other query languages
+
+If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.
+
+<AccordionGroup>
+<Accordion title="Splunk SPL users">
+
+In Splunk SPL, you typically use the `len` function to calculate the number of characters in a string. In APL, you use `string_size` to calculate the number of bytes in a string.
+
+<CodeGroup>
+```sql Splunk example
+... | eval uri_length=len(uri)
+````
+
+```kusto APL equivalent
+['sample-http-logs']
+| extend uri_length = string_size(uri)
+```
+
+</CodeGroup>
+
+</Accordion>
+<Accordion title="ANSI SQL users">
+
+In ANSI SQL, you use the `LENGTH` or `CHAR_LENGTH` function to calculate string length. In APL, the equivalent is `string_size` to calculate the number of bytes in a string.
+
+<CodeGroup>
+```sql SQL example
+SELECT LENGTH(uri) AS uri_length
+FROM sample_http_logs;
+```
+
+```kusto APL equivalent
+['sample-http-logs']
+| extend uri_length = string_size(uri)
+```
+
+</CodeGroup>
+
+</Accordion>
+</AccordionGroup>
+
+## Usage
+
+### Syntax
+
+```kusto
+string_size(source)
+```
+
+### Parameters
+
+| Parameter | Type     | Description                  |
+| --------- | -------- | ---------------------------- |
+| `source`  | `string` | The input string expression. |
+
+### Returns
+
+An integer representing the number of bytes in the string. If the string is empty, the function returns `0`.
+
+## Use case examples
+
+<Tabs>
+<Tab title="Log analysis">
+
+You can use `string_size` to detect unusually long URIs that might indicate an attempted exploit or malformed request.
+
+**Query**
+
+```kusto
+['sample-http-logs']
+| extend uri_length = string_size(uri)
+| where uri_length > 100
+| project _time, method, uri, uri_length, status
+```
+
+[Run in Playground](https://play.axiom.co/axiom-play-qf1k/query?initForm=%7B%22apl%22%3A%22%5B'sample-http-logs'%5D%20%7C%20extend%20uri_length%20%3D%20string_size%28uri%29%20%7C%20where%20uri_length%20%3E%2010%20%7C%20project%20_time%2C%20method%2C%20uri%2C%20uri_length%2C%20status%22%7D)
+
+**Output**
+
+| _time               | method | uri                               | uri_length | status |
+| -------------------- | ------ | --------------------------------- | ----------- | ------ |
+| 2025-09-11T10:01:45Z | GET    | /search/products?q=...            | 142         | 200    |
+| 2025-09-11T10:02:13Z | POST   | /checkout/submit/order/details... | 187         | 400    |
+
+This query finds all HTTP requests with URIs longer than 10 characters and lists their details.
+
+</Tab>
+<Tab title="OpenTelemetry traces">
+
+You can measure the length of trace IDs or span IDs to ensure data consistency and identify malformed identifiers.
+
+**Query**
+
+```kusto
+['otel-demo-traces']
+| extend trace_length = string_size(trace_id)
+| summarize avg_length = avg(trace_length) by ['service.name']
+```
+
+[Run in Playground](https://play.axiom.co/axiom-play-qf1k/query?initForm=%7B%22apl%22%3A%22%5B'otel-demo-traces'%5D%20%7C%20extend%20trace_length%20%3D%20string_size%28trace_id%29%20%7C%20summarize%20avg_length%20%3D%20avg%28trace_length%29%20by%20%5B'service.name'%5D%22%7D)
+
+**Output**
+
+| service.name    | avg_length |
+| --------------- | ----------- |
+| frontend        | 32          |
+| checkoutservice | 32          |
+| loadgenerator   | 31.8        |
+
+This query calculates the average trace ID length per service to verify identifier consistency across the system.
+
+</Tab>
+<Tab title="Security logs">
+
+You can check for anomalous user IDs by looking at the length of the `id` field. Very short or very long IDs may signal invalid or suspicious activity.
+
+**Query**
+
+```kusto
+['sample-http-logs']
+| extend id_length = string_size(id)
+| where id_length < 5 or id_length > 20
+| project _time, id, id_length, status, ['geo.country']
+```
+
+[Run in Playground](https://play.axiom.co/axiom-play-qf1k/query?initForm=%7B%22apl%22%3A%22%5B'sample-http-logs'%5D%20%7C%20extend%20id_length%20%3D%20string_size(id)%20%7C%20where%20id_length%20%3C%205%20or%20id_length%20%3E%2020%20%7C%20project%20_time%2C%20id%2C%20id_length%2C%20status%2C%20%5B'geo.country'%5D%22%7D)
+
+**Output**
+
+| _time               | id                            | id_length | status | geo.country |
+| -------------------- | ----------------------------- | ---------- | ------ | ----------- |
+| 2025-09-11T09:55:01Z | a12                           | 3          | 401    | US          |
+| 2025-09-11T09:58:42Z | user_long_id_example_test | 24         | 200    | DE          |
+
+This query detects requests with suspiciously short or long user IDs, which might indicate invalid credentials or malicious activity.
+
+</Tab>
+</Tabs>

apl/scalar-functions/time-series/overview.mdx

@@ -12,8 +12,12 @@ The table summarizes the time series functions available in APL.
 | [series_acos](/apl/scalar-functions/time-series/series-acos)                           | Returns the inverse cosine (arccos) of a series.            |
 | [series_asin](/apl/scalar-functions/time-series/series-asin)                           | Returns the inverse sine (arcsin) of a series.            |
 | [series_atan](/apl/scalar-functions/time-series/series-atan)                           | Returns the inverse tangent (arctan) of a series.            |
+| [series_cos](/apl/scalar-functions/time-series/series-cos)                           | Returns the cosine of a series.            |
 | [series_greater](/apl/scalar-functions/time-series/series-greater)                           | Returns the elements of a series that are greater than a specified value.            |
 | [series_greater_equals](/apl/scalar-functions/time-series/series-greater-equals)                           | Returns the elements of a series that are greater than or equal to a specified value.            |
 | [series_less](/apl/scalar-functions/time-series/series-less)                           | Returns the elements of a series that are less than a specified value.            |
 | [series_less_equals](/apl/scalar-functions/time-series/series-less-equals)                           | Returns the elements of a series that are less than or equal to a specified value.            |
 | [series_not_equals](/apl/scalar-functions/time-series/series-not-equals)                           | Returns the elements of a series that aren’t equal to a specified value.            |
+| [series_sin](/apl/scalar-functions/time-series/series-sin)                           | Returns the sine of a series.            |
+| [series_sum](/apl/scalar-functions/time-series/series-sum)                           | Returns the sum of a series.            |
+| [series_tan](/apl/scalar-functions/time-series/series-tan)                           | Returns the tangent of a series.            |

apl/scalar-functions/time-series/series-cos.mdx

@@ -0,0 +1,153 @@
+---
+title: series_cos
+description: 'This page explains how to use the series_cos function in APL.'
+---
+
+The `series_cos` function returns the cosine of each element in a numeric array. You can use it to apply trigonometric transformations across entire time series or vectorized data in one step. This function is useful when you want to analyze periodic patterns, normalize angles, or apply mathematical transformations to series data such as request durations, response times, or trace latencies.
+
+You often use `series_cos` together with other series functions like `series_sin` and `series_tan` to perform mathematical modeling, anomaly detection, or seasonality analysis in logs and telemetry data.
+
+## For users of other query languages
+
+If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.
+
+<AccordionGroup>
+<Accordion title="Splunk SPL users">
+
+In Splunk SPL, trigonometric functions like `cos` operate on single field values, not on arrays. To compute cosine across multiple values, you typically expand the values into events and then apply the `eval cos(field)` transformation. In APL, `series_cos` works natively on dynamic arrays, so you can directly transform an entire series in one call.
+
+<CodeGroup>
+```sql Splunk example
+... | eval cos_val=cos(angle)
+````
+
+```kusto APL equivalent
+print arr=dynamic([0, 1.57, 3.14])
+| extend cos_arr=series_cos(arr)
+```
+
+</CodeGroup>
+
+</Accordion>
+<Accordion title="ANSI SQL users">
+
+ANSI SQL does not provide direct support for array-wide trigonometric functions. The `COS()` function only works on single numeric values. To achieve array-like functionality, you usually need to unnest arrays and apply `COS()` row by row. In APL, `series_cos` eliminates this need by directly accepting an array and returning a transformed array.
+
+<CodeGroup>
+```sql SQL example
+SELECT COS(angle) AS cos_val
+FROM Angles;
+```
+
+```kusto APL equivalent
+print arr=dynamic([0, 1.57, 3.14])
+| extend cos_arr=series_cos(arr)
+```
+
+</CodeGroup>
+
+</Accordion>
+</AccordionGroup>
+
+## Usage
+
+### Syntax
+
+```kusto
+series_cos(array)
+```
+
+### Parameters
+
+| Parameter | Type                       | Description                 |
+| --------- | -------------------------- | --------------------------- |
+| `array`   | dynamic (array of numbers) | An array of numeric values. |
+
+### Returns
+
+A dynamic array where each element is the cosine of the corresponding input element.
+
+## Use case examples
+
+<Tabs>
+<Tab title="Log analysis">
+
+You want to model periodic patterns in request durations by applying the cosine function to the values. This is useful if you want to normalize cyclical metrics for further analysis.
+
+**Query**
+
+```kusto
+['sample-http-logs']
+| summarize durations=make_list(req_duration_ms) by id
+| extend cos_durations=series_cos(durations)
+```
+
+[Run in Playground](https://play.axiom.co/axiom-play-qf1k/query?initForm=%7B%22apl%22%3A%22%5B'sample-http-logs'%5D%20%7C%20summarize%20durations%3Dmake_list(req_duration_ms)%20by%20id%20%7C%20extend%20cos_durations%3Dseries_cos(durations)%22%7D)
+
+**Output**
+
+| id | durations        | cos_durations           |
+| -- | ---------------- | ------------------------ |
+| u1 | [120, 300, 450] | [0.814, -0.990, -0.737] |
+| u2 | [50, 250, 400]  | [0.965, -0.801, -0.966] |
+
+This query collects request durations per user ID and applies the cosine transformation to the entire array.
+
+</Tab>
+<Tab title="OpenTelemetry traces">
+
+You want to apply trigonometric transformations to span durations to explore cyclical behavior in distributed traces.
+
+**Query**
+
+```kusto
+['otel-demo-traces']
+| summarize spans=make_list(duration) by ['service.name']
+| extend cos_spans=series_cos(spans)
+```
+
+[Run in Playground](https://play.axiom.co/axiom-play-qf1k/query?initForm=%7B%22apl%22%3A%22%5B'otel-demo-traces'%5D%20%7C%20summarize%20spans%3Dmake_list(duration)%20by%20%5B'service.name'%5D%20%7C%20extend%20cos_spans%3Dseries_cos(spans)%22%7D)
+
+**Output**
+
+| service.name    | spans                 | cos_spans        |
+| --------------- | --------------------- | ----------------- |
+| frontend        | [00:00:01, 00:00:03] | [0.540, -0.990]  |
+| checkoutservice | [00:00:02, 00:00:04] | [-0.416, -0.653] |
+
+This query groups spans by service and computes the cosine for each span duration, which can be used in advanced mathematical modeling of latency patterns.
+
+</Tab>
+<Tab title="Security logs">
+
+You want to explore whether cosine transformations reveal patterns in request durations for suspicious traffic sources.
+
+**Query**
+
+```kusto
+['sample-http-logs']
+| summarize durations=make_list(req_duration_ms) by ['geo.country']
+| extend cos_blocked=series_cos(durations)
+```
+
+[Run in Playground](https://play.axiom.co/axiom-play-qf1k/query?initForm=%7B%22apl%22%3A%22%5B'sample-http-logs'%5D%20%7C%20summarize%20durations%3Dmake_list(req_duration_ms)%20by%20%5B'geo.country'%5D%20%7C%20extend%20cos_blocked%3Dseries_cos(durations)%22%7D)
+
+**Output**
+
+| geo.country | blocked_durations | cos_blocked             |
+| ----------- | ------------------ | ------------------------ |
+| US          | [200, 400, 600]   | [-0.416, -0.653, 0.960] |
+| DE          | [100, 250, 500]   | [0.540, -0.801, 0.284]  |
+
+This query applies the cosine function to blocked request durations grouped by country, which can help highlight periodic access attempts from malicious sources.
+
+</Tab>
+</Tabs>
+
+## List of related functions
+
+- [series_abs](/apl/scalar-functions/time-series/series-abs): Returns the absolute value of each element in an array. Use it to normalize negative values in arrays.
+- [series_acos](/apl/scalar-functions/time-series/series-acos): Computes the arccosine of each element in an array. Use when you want the inverse cosine.
+- [series_atan](/apl/scalar-functions/time-series/series-atan): Computes the arctangent of each element in an array. Use when you want the inverse tangent.
+- [series_sin](/apl/scalar-functions/time-series/series-sin): Returns the sine of each element in an array. Use it when analyzing cyclical data with a phase shift.
+- [series_tan](/apl/scalar-functions/time-series/series-tan): Returns the tangent of each element in an array. Use it when you want to transform arrays with tangent-based periodicity.