Error 'unexpected format: "%N" found in 10 byte' when running pantherlog parse

Last updated
Save as PDF

Issue

When trying to use pantherlog parse with my sample data and schema, the following error occurs:

Error: Received unexpected error: Field_0_Auth: Field_7_Token_policies: []null.String: Field_6_Token_issue_time: DecodeTime: failed to parse "2023-04-12 11:24:59.000000000" with "%Y-%m-%d %H:%M:%S.%N": unexpected format: "%N", error found in #10 byte of ...|000000000"|..., bigger context ...| "2023-04-12 11:24:59.000000000"|... parse failed

Resolution

To resolve this issue:

Update your pantherlog tool to the latest version.
Check that your $PATH environment variable is pointing to the latest executable if not calling directly. (echo $PATH)
If you are seeing "developer cannot be verified", use the instructions in this article to resolve it.

Cause

This issue occurs when the pantherlog tool is out of date.