Median / 2nd quartile / Percentile 50 (median)
- Juan Tomás Alonso Nieto (Deactivated)
- Sarah Bigault (Deactivated)
Description
Returns the median of the values found in a specified column for each grouping occurrence.
How does it work in the search window?
Before being able to perform this operation, you have to group your data. Be aware that the columns used as arguments for the grouping operation will not be available to select as arguments for the aggregation operation.
After grouping the data, select Aggregation in the search window toolbar, then select the Median / 2nd quartile / Percentile 50 operation. You need to specify one argument:
Argument | Data type |
|---|---|
Source mandatory | integer |
The data type of the aggregated values is integer.
Example
In the siem.logtrust.web.activity table, we want to get the median of the bytesTransferred column values in each 5-minute period. Before aggregating the data, the table must be grouped in 5-minute intervals. Then we will perform the aggregation using the Median / 2nd quartile / Percentile 50 operation.
The arguments needed for the Median / 2nd quartile / Percentile 50 operation are:
Source → bytesTransferred column
Click Aggregate function and you will see the following result:
How does it work in LINQ?
Group your data using the following structure:
group every server period by column1, column2...every client period
Then, use select... as... to add the new column that will show the aggregated values. This is the syntax for the Median / 2nd quartile / Percentile 50 operation:
median(integer_column)
See Build a query using LINQ to learn more about grouping and aggregating your data using the LINQ language.
Example
You can copy the following LINQ script and try the example above on the siem.logtrust.web.activity table:
from siem.logtrust.web.activity
group every 5m
every 5m
select median(responseTime) as `median_response time`