I've run across two major causes of JsonLineBreaker errors.
One cause is character set encoding. It's not enough to want, or intend, to use the UTF-8 character set for writing your JSON or JSONL. You must succeed. Use a UTF-8 validator as the first step in debugging a JsonLineBreaker error. validation - How to check whether a file is valid UTF-8? - Stack Overflow
There are some JSON validators out there. Not all of them check the character set encoding. (I should add, JSON can also be written using UTF-16 or UTF-32.)
A second cause of JsonLineBreaker errors is allowing Splunk to read your JSON or JSONL file, while you are writing it. Splunk is very aggressive about reading files while you're still writing to them. If Splunk hits end-of-file on a JSON or JSONL file before it's fully formed, that can cause JsonLineBreaker errors.
There's a simple trick to avoid this problem. Suppose you have Splunk configured to read files ending with .json or .jsonl. Write your JSON to a file with an name Splunk isn't configured to read. Call it c:\temp\my_important_json_file.tmp. When you get finished, close the file. Then rename it from my_important_json_file.tmp to my_important_json_file.json.
There may be smarter ways of handling this race condition between Splunk and your JSON writer, but this one works.
