> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/median_with_comp_stage.md).

# median (comp)

Use the `median()` function to return the median (middle value) of a specified numeric field across all rows in each group within the `comp` stage. For an even number of values, it returns the average of the two middle values. This is equivalent to computing the 50th percentile.

## Syntax

```sql
| comp median(<field>) [by <group_field1>, <group_field2>, ...] [as <alias>]
```

## Parameters

| Name          | Type    | Required | Description                                                                                          |
| ------------- | ------- | -------- | ---------------------------------------------------------------------------------------------------- |
| `field`       | numeric | Yes      | The numeric field from which to compute the median value.                                            |
| `group_field` | any     | No       | One or more fields to group the results by. If omitted, all rows are treated as a single group.      |
| `alias`       | string  | No       | An alias for the output field. If not specified, the output field name defaults to `median_<field>`. |

## Returns

**Type**: numeric (float)

**Description**: The `median()` function returns the median value of the specified field within each group. Returns NULL if all values in the group are NULL.

## Usage notes

* **Numeric only**: The `median` function only works with numeric fields.
* **Null handling**: NULL values are ignored in the computation.
* **Odd count**: For an odd number of non-NULL values, the median is the middle value when sorted.
* **Even count**: For an even number of non-NULL values, the median is the average of the two middle values.
* **Return type**: The result is always returned as a floating-point number.
* **No grouping**: When used without a `by` clause, the function computes the median across all rows.

## Examples

### Example 1: Median response time per endpoint

**Goal**: Compute the median response time for each host.

**XQL code**:

```sql
dataset = xdr_data
| comp median(action_total_time) by agent_hostname as median_response_time
```

**Explanation**: The `median()` function computes the middle value of `action_total_time` for each unique `agent_hostname`, providing a representative response time that is less affected by outliers than the average.

**Output**:

| AGENT\_HOSTNAME | MEDIAN\_RESPONSE\_TIME |
| --------------- | ---------------------- |
| workstation-1   | 45.5                   |
| workstation-2   | 32.0                   |

### Example 2: Overall median of bytes received

**Goal**: Compute the overall median of bytes received across all events.

**XQL code**:

```sql
dataset = xdr_data
| comp median(action_network_bytes_received) as median_bytes
```

**Explanation**: Without a `by` clause, the `median()` function computes the median of `action_network_bytes_received` across all rows, returning a single value.

**Output**:

| MEDIAN\_BYTES |
| ------------- |
| 1024.5        |

## Related articles

* **Stages**: [`comp`](/xql-command-reference-guide/readme/stages/comp.md), [`fields`](/xql-command-reference-guide/readme/stages/fields.md), [`limit`](/xql-command-reference-guide/readme/stages/limit.md)
* **Functions**: [`median (windowcomp)`](/xql-command-reference-guide/readme/functions/median_with_windowcomp_stage.md), [`avg()`](/xql-command-reference-guide/readme/functions/avg_with_comp_stage.md), [`max()`](/xql-command-reference-guide/readme/functions/max_with_comp_stage.md)
* **Datasets**: [`xdr_data`](https://docs-cortex.paloaltonetworks.com/r/Cortex-XQL-Schema-Reference-Guide/Introduction)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/median_with_comp_stage.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.