crowdsecurity/crowdsec · error

need at least two times to calculate a median

Error message

need at least two times to calculate a median

What it means

Guard in MedianInterval: fewer than two time values were supplied, so no interval exists to take a median of. Usually means the source event had only one (or zero) parsed timestamps feeding the helper.

Solutions

1. Ensure the expression feeding MedianInterval yields at least two timestamps
2. If single-event sources are expected, guard the scenario expression to skip the call

When it happens

Trigger: Thrown at pkg/exprhelpers/helpers.go:729 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/4e8298140c403945. Report an issue: GitHub.

Appendix: source

Thrown at pkg/exprhelpers/helpers.go:729

	// Handle both []time.Time and []interface{} (from expr map function)
	switch v := params[0].(type) {
	case []time.Time:
		times = v
	case []interface{}:
		times = make([]time.Time, len(v))
		for i, item := range v {
			t, ok := item.(time.Time)
			if !ok {
				return 0, fmt.Errorf("element at index %d is not a time.Time", i)
			}
			times[i] = t
		}
	default:
		return 0, errors.New("MedianInterval expects a slice of times")
	}

	if len(times) < 2 {
		return 0, errors.New("need at least two times to calculate a median")
	}

	// Sort times
	sort.Slice(times, func(i, j int) bool {
		return times[i].Before(times[j])
	})

	// Compute intervals
	intervals := make([]time.Duration, len(times)-1)
	for i := 1; i < len(times); i++ {
		intervals[i-1] = times[i].Sub(times[i-1])
	}

	// Sort intervals for median calculation
	slices.Sort(intervals)

	n := len(intervals)
	if n%2 == 1 {

View on GitHub (pinned to 909b515798)