For median calculation, I considered only disinct values and not all values! This was a wrong way to calculate ... View more

Given the limited example of what you are trying to do, can you do something with eventstats | eventstats values(start) as start values(end) as end | eval start=if(_time>=start AND _time <= end, start, null()) | eval end=if(_time>=start AND _time <= end, end, null()) ... View more