{"record":{"id":"4e8298140c403945","repo":"crowdsecurity/crowdsec","slug":"need-at-least-two-times-to-calculate-a-median","errorCode":null,"errorMessage":"need at least two times to calculate a median","messagePattern":"need at least two times to calculate a median","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/exprhelpers/helpers.go","lineNumber":729,"sourceCode":"\t// Handle both []time.Time and []interface{} (from expr map function)\n\tswitch v := params[0].(type) {\n\tcase []time.Time:\n\t\ttimes = v\n\tcase []interface{}:\n\t\ttimes = make([]time.Time, len(v))\n\t\tfor i, item := range v {\n\t\t\tt, ok := item.(time.Time)\n\t\t\tif !ok {\n\t\t\t\treturn 0, fmt.Errorf(\"element at index %d is not a time.Time\", i)\n\t\t\t}\n\t\t\ttimes[i] = t\n\t\t}\n\tdefault:\n\t\treturn 0, errors.New(\"MedianInterval expects a slice of times\")\n\t}\n\n\tif len(times) < 2 {\n\t\treturn 0, errors.New(\"need at least two times to calculate a median\")\n\t}\n\n\t// Sort times\n\tsort.Slice(times, func(i, j int) bool {\n\t\treturn times[i].Before(times[j])\n\t})\n\n\t// Compute intervals\n\tintervals := make([]time.Duration, len(times)-1)\n\tfor i := 1; i < len(times); i++ {\n\t\tintervals[i-1] = times[i].Sub(times[i-1])\n\t}\n\n\t// Sort intervals for median calculation\n\tslices.Sort(intervals)\n\n\tn := len(intervals)\n\tif n%2 == 1 {","sourceCodeStart":711,"sourceCodeEnd":747,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/exprhelpers/helpers.go#L711-L747","documentation":"Guard in MedianInterval: fewer than two time values were supplied, so no interval exists to take a median of. Usually means the source event had only one (or zero) parsed timestamps feeding the helper.","triggerScenarios":"Thrown at pkg/exprhelpers/helpers.go:729 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Ensure the expression feeding MedianInterval yields at least two timestamps","If single-event sources are expected, guard the scenario expression to skip the call"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}