Issue

When I run a particular query in the Data Explorer it works, but when I take the same query and turn it into a Scheduled Query I get the following error:

FailedQuery('status: failed error: SYNTAXERROR: line 1:89: Table awsdatacatalog.panthertemp.custom_tablename does not exist')

Resolution

To resolve this issue: Edit your scheduled query, and ensure that any reference to the table name that you wish to query is fully qualified. For example, if your query is:

select * from custom_tablename

Try changing it to:

select * from panther_logs.public.custom_tablename

The above is used if your database backend is Snowflake. If you are using Athena, you would use panther_logs.custom_tablename(you would not include the .public.)

Cause

This issue can occur specifically for Scheduled Queries when the name of the table is not fully qualified.

Panther uses multiple databases that each have many table names. If you just provide the name of the table without providing the fully qualified name, the Scheduled Query might not know which table to use and it might assume the wrong database, which leads to the error saying the table does not exist.

The reason this happens specifically for Scheduled Queries and not for ad-hoc queries in the Data Explorer is that in the Data Explorer it knows which database to use based on your selection in the UI. For this reason, in general it is better to use a fully qualified table name in your queries to avoid ambiguity.