medianif ​

The medianif aggregation function returns the middle value of Expression across the group for which Predicate evaluates to true.

Use this function with the summarize, eventstats, and timestats operators.

Syntax ​

medianif( Expression, Predicate )

Arguments ​

• Expression: Expression used for aggregation calculation. Wildcards are not supported for field names.
• Predicate: Expression that will be used to filter rows.

Example ​

dataset=myDataset
| summarize medianif(data, host=="Cribl.local")