I'd suspect that most probable culprits are line breaks and quotation marks. https://docs.splunk.com/Documentation/Splunk/9.0.1/Alert/EmailNotificationTokens#Result_tokens I don't see any mention about the fields being escaped in any way. So if you get, for example: { field1: "My result is: "whatever"!"} after substitiution of the tokens, it does not constitute a correct json document. You could try to escape "tricky" characters in your alert output so that the log event receives "safe" strings. ... View more