This query will report back the median duration of a session within an IIS web environment. The time format will be HH:MM:SS

sourcetype="iis" | stats range(_time) as duration by JSESSIONID | stats median(duration) as AVD | fieldformat AVD=tostring(AVD,"duration") | eval AVD=round(AVD, 0)