Hi,
I think the median calculation is incorrect when the total amount of values is an even number.
An example:
359
282
224
150
60
52
8
1
0
0
Splunk tells me the median is 60, but it should be 56.
In this case there is a pair of middle numbers and the median should be calcualted by median=(60+52)/2
Am I correct?
BR
Heinz
That's the documented behaviour as per http://docs.splunk.com/Documentation/Splunk/6.1.3/SearchReference/CommonStatsFunctions
median(X): This function returns the middle-most value of the field X.
Note: The median calculation is more correct for odd numbers of events. In cases where you have
an even number of events, the median is approximated to be the higher of the two values.
That's the documented behaviour as per http://docs.splunk.com/Documentation/Splunk/6.1.3/SearchReference/CommonStatsFunctions
median(X): This function returns the middle-most value of the field X.
Note: The median calculation is more correct for odd numbers of events. In cases where you have
an even number of events, the median is approximated to be the higher of the two values.
That obviously doesn't rule out filing an Enhancement Request with Splunk Support to implement a more accurate median()
function...
oh...thanks!