1. Create a JSON object using all of the available fields

The following search create a JSON object in a field called "data" taking in values from all available fields.

| makeresults count=5 | eval owner="vladimir", error=random()%3 | makejson output=data

• The makeresults command creates five search results that contain a timestamp.
• The eval command creates two fields in each search result. One field is named owner and contains the value vladimir. The other field is named error that takes a random number and uses the modulo mathematical operator ( % ) to divide the random number by 3.
• The makejson command creates a JSON object based on the values in the fields in each search result.

The results look something like this:

2. Create a JSON object from a specific set of fields

Consider the following data:

| makeresults count=7 | eval owner="claudia", error=random()%5 | makejson _time, owner output=data

The results look something like this:

3. Create a JSON object using a wildcard list of fields

Create a JSON object in a field called "json-object" using the values from the _time field and fields that end in _owner.

| makeresults count=5 | eval product_owner="wei", system_owner="vanya", error=random()%5 | makejson _time, *_owner output="json-object"

The results look something like this:

4. Use with schema-bound lookups

You can use the makejson command with schema-bound lookups to store a JSON object in the description field for later processing.

Suppose that a Splunk application comes with a KVStore collection called example_ioc_indicators, with the fields key and description. For long term supportability purposes you do not want to modify the collection, but simply want to utilize a custom lookup within a framework, such as Splunk Enterprise Security (ES) Threat Framework.

Let's start with the first part of the search:

| makeresults count=1 
| eval threat="maliciousdomain.example", threat_expiry="2020-01-01 21:13:37 UTC", threat_name="Sample threat", threat_campaign="Sample threat", threat_confidence="100" 
| makejson threat_expiry, threat_name, threat_campaign, threat_confidence output=description 
| table threat, description

This search produces a result that looks something like this:

You would then add the outputlookup command to send the search results to the lookup:

... | outputlookup append=t example_ioc_indicators

To use this custom lookup within a framework, you would specify this in a search:

...| lookup example_ioc_indicators OUTPUT description AS match_context | spath input=match_context