Splunk not ingesting JSON data and generating JsonLineBreaker errors in Splunkd logs.

Applicability

Splunk Cloud

Description

A specific data input stopped ingesting data.
The following error is in the splunkd log of the instance that is parsing the events:

ERROR JsonLineBreaker - JSON StreamId:12768491381919637733 had parsing error:Unexpected character: ':' - data_source="source", data_host="host", data_sourcetype="sourcetype"ERROR JsonLineBreaker - JSON StreamId:12768491381919637733 had parsing error:Unexpected character while looking for value: '}' - data_source="source, data_host="host", data_sourcetype="sourcetype"

Example of the error in the IDM for a specific data inputs under the Splunk Add-on for Microsoft Cloud Services

ERROR JsonLineBreaker [9999999 parsing] - JSON StreamId:1234567800123412345 had parsing error:Unexpected character while looking for value: 'A' - data_source="event://abcde-abc-us-w.servicebus.windows.net/abcde-abc-splunk;"", data_host="idm-i-12345678abcdef99.<stackName>.splunkcloud.com", data_sourcetype="mscs:azure:eventhub:abcde

Investigation

For the JSON data that is not being ingested, verify if the source type associated with the data not being ingested uses KV_MODE=json and/or INDEXED_EXTRACTIONS=json.

Resolution

The error suggests that there is an issue with parsing the JSON events because the data does not have the expected format. With that, the data source needs to be verified to find any issues with the format. A JSON validator might help on this case, a good example of a JSON validator is jsonlint.
For scripted inputs it's also necessary to make sure the events are written as a whole line and not divided into several pieces.
If the source data is not valid JSON, and cannot be modified, the INDEXED_EXTRACTIONS=json can be removed from the specific source type and ingestion should resume and errors stop.
 

Related Links

props.conf

Revision History

Revision	Publish Date	Comments
1.0	29-Sep-2026	Initial Release