median (comp) ↗

Use the median() function to return the median (middle value) of a specified numeric field across all rows in each group within the comp stage. For an even number of values, it returns the average of the two middle values. This is equivalent to computing the 50th percentile.

Syntax

| comp median(<field>) [by <group_field1>, <group_field2>, ...] [as <alias>]

Parameters

Name	Type	Required	Description
`field`	numeric	Yes	The numeric field from which to compute the median value.
`group_field`	any	No	One or more fields to group the results by. If omitted, all rows are treated as a single group.
`alias`	string	No	An alias for the output field. If not specified, the output field name defaults to `median_<field>`.

Returns

Type: numeric (float)

Description: The median() function returns the median value of the specified field within each group. Returns NULL if all values in the group are NULL.

Usage notes

Numeric only: The median function only works with numeric fields.
Null handling: NULL values are ignored in the computation.
Odd count: For an odd number of non-NULL values, the median is the middle value when sorted.
Even count: For an even number of non-NULL values, the median is the average of the two middle values.
Return type: The result is always returned as a floating-point number.
No grouping: When used without a by clause, the function computes the median across all rows.

Examples

Example 1: Median response time per endpoint

Goal: Compute the median response time for each host.

XQL code:

dataset = xdr_data
| comp median(action_total_time) by agent_hostname as median_response_time

Explanation: The median() function computes the middle value of action_total_time for each unique agent_hostname, providing a representative response time that is less affected by outliers than the average.

Output:

AGENT_HOSTNAME	MEDIAN_RESPONSE_TIME
workstation-1	45.5
workstation-2	32.0

Example 2: Overall median of bytes received

Goal: Compute the overall median of bytes received across all events.