This query will report back the average duration of a session within an IIS web environment. The time format will be HH:MM:SS

sourcetype="iis" | stats range(_time) as duration by JSESSIONID | stats avg(duration) as AVG | fieldformat AVG=tostring(AVG,"duration") | eval AVG=round(AVG, 0)