My Data Explorer view in Panther displays a field with null values, even though I removed the field from my schema. How can I remove this field from the view?

Issue

I removed an event field from my custom log schema. However, this field still appears in Panther's Data Explorer view, displaying a null value. How can I remove this field from the view?

Resolution

To resolve this issue:

1. Follow these instructions to edit your custom log schema, setting the Field Discovery feature to OFF.

2. Wait approximately 5 minutes.

   • Execute a Data Explorer query again, and check if the field is still present.

If the above steps don't resolve this, please contact Panther Support.