Splunk can export events in JSON via the web interface and when queried via the REST api can return JSON output. It can also parse JSON at index/search-time, but it can't *create* JSON at search-time. This app provides a 'mkjson' command that can create a JSON field from a given list or all fields in an event. For usage, please see the documentation: https://github.com/doksu/TA-jsontools/wiki