crowdsecurity/crowdsec · error

AverageInterval expects exactly one parameter: a slice of ti

Error message

AverageInterval expects exactly one parameter: a slice of times

What it means

AverageInterval is an expr-lang helper exposed to expressions that computes the mean gap between timestamps. It requires exactly one argument: a slice of time.Time values. This error is thrown when the expression passes zero arguments or more than one.

Source

Thrown at pkg/exprhelpers/helpers.go:663

		log.Errorf("Could not parse URI: %s", err)
		return ret, nil
	}

	parsed, err := url.ParseQuery(u.RawQuery)
	if err != nil {
		log.Errorf("Could not parse query uri : %s", err)
		return ret, nil
	}

	maps.Copy(ret, parsed)

	return ret, nil
}

// func AverageInterval(times []time.Time) time.Duration
func AverageInterval(params ...any) (any, error) {
	if len(params) != 1 {
		return 0, errors.New("AverageInterval expects exactly one parameter: a slice of times")
	}

	var times []time.Time

	// Handle both []time.Time and []interface{} (from expr map function)
	switch v := params[0].(type) {
	case []time.Time:
		times = v
	case []interface{}:
		times = make([]time.Time, len(v))
		for i, item := range v {
			t, ok := item.(time.Time)
			if !ok {
				return 0, fmt.Errorf("element at index %d is not a time.Time", i)
			}
			times[i] = t
		}
	default:

View on GitHub (pinned to 909b515798)

Solutions

1. Pass exactly one argument: a slice of times, e.g. AverageInterval(evt.Meta.timestamps)
2. If using expr's map(), make sure its result is passed as a single value: AverageInterval(map(t, ...))
3. Check the scenario expression signature against the helper docs

Example fix

// before
AverageInterval(evt.Meta.t1, evt.Meta.t2)
// after
AverageInterval(map(evt.Meta.event_times, #))

// in scenario/expr validation
if len(args) != 1 {
    return errors.New("AverageInterval takes exactly one slice argument")
}

When it happens

Trigger: An expr expression calls AverageInterval() with no args, or passes multiple separate args like AverageInterval(t1, t2) instead of a single slice.

Common situations: Writing a custom scenario expression and forgetting to wrap timestamps in a slice, e.g. using map/filter output split across arguments.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

• AverageInterval expects a slice of times
• need at least two times to calculate an average interval
• missing filter directive
• leaky failed :/
• groupby wrong type

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/b9f5310aad426a7c. Report an issue: GitHub.