crowdsecurity/crowdsec · error

need at least two times to calculate a median

Error message

need at least two times to calculate a median

What it means

Guard in MedianInterval: fewer than two time values were supplied, so no interval exists to take a median of. Usually means the source event had only one (or zero) parsed timestamps feeding the helper.

Source

Thrown at pkg/exprhelpers/helpers.go:729

	// Handle both []time.Time and []interface{} (from expr map function)
	switch v := params[0].(type) {
	case []time.Time:
		times = v
	case []interface{}:
		times = make([]time.Time, len(v))
		for i, item := range v {
			t, ok := item.(time.Time)
			if !ok {
				return 0, fmt.Errorf("element at index %d is not a time.Time", i)
			}
			times[i] = t
		}
	default:
		return 0, errors.New("MedianInterval expects a slice of times")
	}

	if len(times) < 2 {
		return 0, errors.New("need at least two times to calculate a median")
	}

	// Sort times
	sort.Slice(times, func(i, j int) bool {
		return times[i].Before(times[j])
	})

	// Compute intervals
	intervals := make([]time.Duration, len(times)-1)
	for i := 1; i < len(times); i++ {
		intervals[i-1] = times[i].Sub(times[i-1])
	}

	// Sort intervals for median calculation
	slices.Sort(intervals)

	n := len(intervals)
	if n%2 == 1 {

View on GitHub (pinned to 909b515798)

Solutions

1. Ensure the expression feeding MedianInterval yields at least two timestamps
2. If single-event sources are expected, guard the scenario expression to skip the call

When it happens

Trigger: Thrown at pkg/exprhelpers/helpers.go:729 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/4e8298140c403945. Report an issue: GitHub.