crowdsecurity/crowdsec · error

MedianInterval expects exactly one parameter: a slice of…

Error message

MedianInterval expects exactly one parameter: a slice of times

What it means

Arity guard in the MedianInterval expr helper: it was invoked from a scenario expression with more or fewer than exactly one argument. The single argument must be the slice of times to measure intervals over.

Solutions

1. Call MedianInterval with exactly one parameter, e.g. MedianInterval(EvtInt1.GetAll())
2. Remove extra arguments from the scenario expression

When it happens

Trigger: Thrown at pkg/exprhelpers/helpers.go:706 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/b8c79909cb30f7d1. Report an issue: GitHub.

Appendix: source

Thrown at pkg/exprhelpers/helpers.go:706

	// Sort times in ascending order
	sort.Slice(times, func(i, j int) bool {
		return times[i].Before(times[j])
	})

	var total time.Duration
	for i := 1; i < len(times); i++ {
		total += times[i].Sub(times[i-1])
	}

	average := time.Duration(int64(total) / int64(len(times)-1))
	return average, nil
}

// func MedianInterval(times []time.Time) (time.Duration, error)
func MedianInterval(params ...any) (any, error) {
	if len(params) != 1 {
		return 0, errors.New("MedianInterval expects exactly one parameter: a slice of times")
	}

	var times []time.Time

	// Handle both []time.Time and []interface{} (from expr map function)
	switch v := params[0].(type) {
	case []time.Time:
		times = v
	case []interface{}:
		times = make([]time.Time, len(v))
		for i, item := range v {
			t, ok := item.(time.Time)
			if !ok {
				return 0, fmt.Errorf("element at index %d is not a time.Time", i)
			}
			times[i] = t
		}
	default:

View on GitHub (pinned to 909b515798)