Error: 'InvalidLogSchema: Field Discovery can only be enabled with JSON or CSV data with header' when updating or creating a schema in Panther

QUESTION

I get the error: InvalidLogSchema: Field Discovery can only be enabled with JSON or CSV data with header when updating or creating a schema in Panther. How can I resolve this issue?

ANSWER

• If you intend to enable Field Discovery in your schema, make sure to use the expected format. Field discovery can only be enabled for JSON and CSV with header log schemas.

• If you did not intend to enable Field Discovery in your schema, turn off the "Field Discovery" button in your Panther Console for your schema and try saving again.