How to to take median of number of users logged in past 1 hour

[Rocky31]

index=XXX sourcetype="XXX-log" opName="LoginUser"    earliest=-60m latest=now()   | bucket _time span=10m | timechart  count

Any help would be appriciated 🙂

[elliotproebstel]

Based on how you've written your test query above, I think you're saying you want to count the number of user login events per every ten minutes in the last hour and then find the median of those counts. If so:

index=XXX sourcetype="XXX-log" opName="LoginUser"    earliest=-60m latest=now()
| bin _time span=10m
| stats count by _time
| stats median(count) as median_count

[Rocky31]

Thanks much for the help 🙂

can you also guide me on how to take median of 2 weeks (current and last week ) of past 1 hr values on same day of the week.

index=XXX sourcetype="XXX-log" opName="LoginUser" earliest=-60m latest=now() | bin _time span=10m | stats count by _time | stats median(count) as median_count | appendcols [search index=XXX sourcetype="XXX-log" opName="LoginUser" earliest=-10140m latest=-10080m | bucket _time span=10m |timechart count as LastWeek