QUESTION

When ingesting Parquet logs into Panther, unsigned integer fields (e.g. uint32, uint64) such as inode numbers, UIDs, and pointers are showing up as negative values. How do I resolve this?

ANSWER

Panther supports signed integers int (32-bit signed) and bigint (64-bit signed). When Panther reads Parquet columns annotated as UINT_32 or UINT_64, the raw bits are interpreted as their signed equivalents, which can produce negative values.

The recommended workaround is to define unsigned integer fields as bigint in your Panther custom schema.

The only caveat is that values larger than approximately 9.22 × 10¹⁸ (the maximum value of a signed 64-bit integer) would overflow.