https://community.splunk.com/t5/Getting-Data-In/ERROR-JsonLineBreaker-causes/m-p/555508#M92006 <P>I've run across two major causes of JsonLineBreaker errors.</P><P>One cause is character set encoding.&nbsp; It's not enough to want, or intend, to use the UTF-8 character set for writing your JSON or JSONL.&nbsp; You must succeed.&nbsp; Use a UTF-8 validator as the first step in debugging a JsonLineBreaker error.&nbsp; &nbsp;<A href="https://stackoverflow.com/questions/115210/how-to-check-whether-a-file-is-valid-utf-8" target="_blank" rel="noopener">validation - How to check whether a file is valid UTF-8? - Stack Overflow</A></P><P>There are some JSON validators out there.&nbsp; Not all of them check the character set encoding.&nbsp; (I should add, JSON can also be written using UTF-16 or UTF-32.)</P><P>A second cause of JsonLineBreaker errors is allowing Splunk to read your JSON or JSONL file, while you are writing it.&nbsp; Splunk is very aggressive about reading files while you're still writing to them.&nbsp; If Splunk hits end-of-file on a JSON or JSONL file before it's fully formed, that can cause JsonLineBreaker errors.&nbsp;</P><P>There's a simple trick to avoid this problem.&nbsp; Suppose you have Splunk configured to read files ending with .json or .jsonl.&nbsp; Write your JSON to a file with an name Splunk isn't configured to read.&nbsp; Call it c:\temp\my_important_json_file.tmp.&nbsp; When you get finished, close the file.&nbsp; Then rename it from my_important_json_file.tmp to my_important_json_file.json.</P><P>There may be smarter ways of handling this race condition between Splunk and your JSON writer, but this one works.</P> Fri, 11 Jun 2021 19:09:11 GMT pgriffith 2021-06-11T19:09:11Z https://community.splunk.com/t5/Getting-Data-In/ERROR-JsonLineBreaker-causes/m-p/555508#M92006 <P>I've run across two major causes of JsonLineBreaker errors.</P><P>One cause is character set encoding.&nbsp; It's not enough to want, or intend, to use the UTF-8 character set for writing your JSON or JSONL.&nbsp; You must succeed.&nbsp; Use a UTF-8 validator as the first step in debugging a JsonLineBreaker error.&nbsp; &nbsp;<A href="https://stackoverflow.com/questions/115210/how-to-check-whether-a-file-is-valid-utf-8" target="_blank" rel="noopener">validation - How to check whether a file is valid UTF-8? - Stack Overflow</A></P><P>There are some JSON validators out there.&nbsp; Not all of them check the character set encoding.&nbsp; (I should add, JSON can also be written using UTF-16 or UTF-32.)</P><P>A second cause of JsonLineBreaker errors is allowing Splunk to read your JSON or JSONL file, while you are writing it.&nbsp; Splunk is very aggressive about reading files while you're still writing to them.&nbsp; If Splunk hits end-of-file on a JSON or JSONL file before it's fully formed, that can cause JsonLineBreaker errors.&nbsp;</P><P>There's a simple trick to avoid this problem.&nbsp; Suppose you have Splunk configured to read files ending with .json or .jsonl.&nbsp; Write your JSON to a file with an name Splunk isn't configured to read.&nbsp; Call it c:\temp\my_important_json_file.tmp.&nbsp; When you get finished, close the file.&nbsp; Then rename it from my_important_json_file.tmp to my_important_json_file.json.</P><P>There may be smarter ways of handling this race condition between Splunk and your JSON writer, but this one works.</P> Fri, 11 Jun 2021 19:09:11 GMT https://community.splunk.com/t5/Getting-Data-In/ERROR-JsonLineBreaker-causes/m-p/555508#M92006 pgriffith 2021-06-11T19:09:11Z