Skip to main content
Panther Knowledge Base

How do I resolve a "DecodeTime: failed to parse" error for a custom schema in Panther?


I'm seeing this error message for one of my custom schemas:

DecodeTime: failed to parse "2022-08-06 19:19:56+00:00" with "%Y-%m-%d %H:%M:%S.%f%z": expected '.', er…


To resolve this issue, make sure your timestamp is in the correct format. You can have multiple timestamp formats in a single schema

Here's an example for a timestamp field that sometimes includes a fractional second:

- name: ts
    type: timestamp
      - "%Y-%m-%d %H:%M:%S %z"
      - "%Y-%m-%d %H:%M:%S.%f %z"


This issue occurs when a timestamp is not formatted correctly.