Why is the result of the median function incorrect when the total number of values is an even number?

[HeinzWaescher]

Hi,

I think the median calculation is incorrect when the total amount of values is an even number.

An example:

359
282
224
150
60
52
8
1
0
0

Splunk tells me the median is 60, but it should be 56.
In this case there is a pair of middle numbers and the median should be calcualted by median=(60+52)/2

Am I correct?

BR

Heinz

[martin_mueller · Accepted solution]

That's the documented behaviour as per http://docs.splunk.com/Documentation/Splunk/6.1.3/SearchReference/CommonStatsFunctions

median(X): This function returns the middle-most value of the field X.
           Note: The median calculation is more correct for odd numbers of events. In cases where you have
           an even number of events, the median is approximated to be the higher of the two values.

[martin_mueller]

That obviously doesn't rule out filing an Enhancement Request with Splunk Support to implement a more accurate median() function...

[HeinzWaescher]

oh...thanks!