Why does my Panther S3 log source show data in Quick Edit but not in Overview, Health, or Data Explorer?

Last updated: June 9, 2026

QUESTION

My S3 log source shows logs when using the Quick Edit view, but no events appear in the log source Overview, Health page, or Data Explorer. Why aren't my logs being ingested?

Screenshot 2026-06-03 at 10.36.38 AM.pngScreenshot 2026-06-04 at 10.50.58 AM.png

ANSWER

Panther's Quick Edit view reads objects directly from your S3 bucket, so if you're seeing data in your Quick Edit view, this confirms that Panther has the correct access permissions.

However, it does not reflect whether Panther's ingestion pipeline has been triggered for those files. If logs appear in Quick Edit but not in Overview, Health, or Data Explorer, the most likely causes are:

  1. The logs failed to parse or were classified under a different schema.

  2. A misconfiguration in the AWS S3 event notification chain is preventing Panther from being notified when new files arrive.

Please refer to the following kb articles that to diagnose and resolve the issue: