When trying to ingest a log source in Panther, I'm getting a classification error that returns empty:
To resolve this issue, check if your log source contains multiple CSV schemas. If it does, edit and add the
columns fields for the CSV schemas.
This issue occurs when a log source has multiple CSV schemas without the
columns field. Panther requires the
columns fields to differentiate between logs.