crowdsecurity/crowdsec · error

MedianInterval expects exactly one parameter: a slice of tim

Error message

MedianInterval expects exactly one parameter: a slice of times

What it means

Arity guard in the MedianInterval expr helper: it was invoked from a scenario expression with more or fewer than exactly one argument. The single argument must be the slice of times to measure intervals over.

Source

Thrown at pkg/exprhelpers/helpers.go:706

	// Sort times in ascending order
	sort.Slice(times, func(i, j int) bool {
		return times[i].Before(times[j])
	})

	var total time.Duration
	for i := 1; i < len(times); i++ {
		total += times[i].Sub(times[i-1])
	}

	average := time.Duration(int64(total) / int64(len(times)-1))
	return average, nil
}

// func MedianInterval(times []time.Time) (time.Duration, error)
func MedianInterval(params ...any) (any, error) {
	if len(params) != 1 {
		return 0, errors.New("MedianInterval expects exactly one parameter: a slice of times")
	}

	var times []time.Time

	// Handle both []time.Time and []interface{} (from expr map function)
	switch v := params[0].(type) {
	case []time.Time:
		times = v
	case []interface{}:
		times = make([]time.Time, len(v))
		for i, item := range v {
			t, ok := item.(time.Time)
			if !ok {
				return 0, fmt.Errorf("element at index %d is not a time.Time", i)
			}
			times[i] = t
		}
	default:

View on GitHub (pinned to 909b515798)

Solutions

1. Call MedianInterval with exactly one parameter, e.g. MedianInterval(EvtInt1.GetAll())
2. Remove extra arguments from the scenario expression

When it happens

Trigger: Thrown at pkg/exprhelpers/helpers.go:706 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/b8c79909cb30f7d1. Report an issue: GitHub.