Median Duration of a Session within an IIS Web Environment

This query will report back the median duration of a session within an IIS web environment. The time format will be HH:MM:SS

sourcetype="iis" | stats range(_time) as duration by JSESSIONID | stats median(duration) as AVD | fieldformat AVD=tostring(AVD,"duration") | eval AVD=round(AVD, 0)
Share This:

Leave A Comment?