Why is my log source classification error in Panther returning an empty object?
Issue
When trying to ingest a log source in Panther, I'm getting a classification error that returns empty:
"errors": []
Resolution
To resolve this issue:
- Please check if your log source contains multiple CSV schemas. If so, please edit and add the
columns
fields for the CSV schemas.
Cause
This issue occurs when a log source has multiple CSV schemas without the columns
field. Panther requires the columns
fields to differentiate between logs.