Skip to main content
Panther Knowledge Base

How to resolve "Failed to infer schema... error found in byte" when inferring schema in Panther

  1. Last updated
  2. Save as PDF

Issue

When trying to infer a schema from a sample of log files, Panther presents the following error: Failed to infer schema: failed to parse line [1] as JSON: ReadString expects '' or n, but found , error in #1 byte of ...|{|..., bigger context ...|{|...

image (4).png

Resolution

To resolve this issue, please ensure your log files are written in JSONL format. This means that each JSON event object must fit on a single line in the file. There are many preprocessors that offer this functionality (i.e. Cribl), but in a pinch, any computer with a bash shell can convert the files using the following steps:

  1. Place all of your sample log files into a separate directory (if they aren't already).
  2. Open a bash terminal (or equivalent), and change directory into the folder with the sample logs.
  3. Run the following bash script:
for f in azure_*; do (cat "${f}"; echo) >> sample_logs.jsonl; done

You should now be able to use the file sample_logs.jsonl to infer a schema.

Cause

This issue is because currently Panther doesn't support parsing JSON objects which span multiple lines.