QUESTION

When testing a custom schema in Panther, the error message shown in the UI appears truncated. Is there a way to see the full error?

ANSWER

If you see a truncated classification error message, you can retrieve the whole error text by querying the classification_failures table directly in Data Explorer.

Use the following query, adjusting the p_occurs_between timeframe to cover when the failure occurred:

SELECT *
FROM panther_monitor.public.classification_failures
WHERE p_occurs_between('2026-04-29 11:01:20Z','2026-04-30 11:01:20Z')
ORDER by p_event_time ASC NULLS LAST
LIMIT 100

Once the results are returned, expand the event JSON to see the full error detail including the raw payload of the event that triggered the failure.