Issue

When attempting to upload data for a custom Lookup Table in Panther, I receive the following error:

Could not upload your lookup data

{"errorMessage":"upload failed for lookup xxxxx-98xx-3xxx-xxxx-417xxxxxx
into : failed to parse line 1: 
{\"payload\":\"{\",\"errors\":... \"error\":\"parse failed: readFieldHash: 
expect \\\", but found \\u0000, error found in #1 byte of ...... }

Resolution

To resolve this issue:

1. Ensure your Lookup Table data is formatted correctly in either CSV or JSONL format.

2. If your data is in JSONL format:

   • Each JSON object should be on a single line, with no line breaks within objects.

   • Remove any extra whitespace or formatting characters between JSON objects.

Example of correct JSONL format:

{"aid": "XXXXXXXXXXXX11010101010101010101","hostname": "XXXXXXX.local"}
{"aid": "XXXXXXXXXXXX11010101010101010103","hostname": "XX23XXX.localdomain"}
{"aid": "XXXXXXXXXXXX11010101010101010104","hostname": "XXX34XX.lan"}
{"aid": "XXXXXXXXXXXX11010101010101010105","hostname": "XXXXX3333-mxx.lan"}
{"aid": "XXXXXXXXXXXX11010101010101010106","hostname": "XXXX77777-MacBook-Pro.local"}

Cause

This issue occurs when the uploaded data for the custom Lookup Table is not properly formatted. Panther expects the data to be in either CSV or JSONL format, and if the content is in JSONL format, each JSON object must be on a single line. When the format doesn't match these expectations, Panther's parser produces an error, resulting in the upload failure.