Repository navigation
Enhancement: Default CSV/JSON Exports for Results #4
Description
Hello,
I'm currently working on a Splunk application to visualize MemNixFS forensic data. While looking through the source code, I noticed the csv_export.cpp and json_export.cpp files.
I have a couple of questions:
- Would it be possible to generate both CSV and TXT outputs by default (similar to what is already done in the forensic/timeline folder), whenever both formats are available (for example M:\search(yara|ioc).txt)?
- Would it also be possible to have top-level csv and json folders, similar to the layout used by MemProcFS?
Having a consistent export structure would make it much easier to build integrations such as Splunk apps.
Thanks!
Activity
Immortal-ibr commentedon Jul 3, 2026
Thanks for you suggestion!
I'll be working on it.
feat: custom YARA rules (#3), CSV/JSON exports (#4), faster warming
ELJoOker2004 commentedon Jul 3, 2026
It's added now by default as a top-level CSV folder that includes everything, but you might need to do --forensic=full in order to precompute all files in memory to not cause problems during integrations; this might take some time on large memory dumps
another export argument is added too, in case you need to just export the CSV files
if you want to test, you can build from source for now until I publish the new release after some testing from my side
Immortal-ibr commentedon Jul 4, 2026
The new release is published now.
Thanks for your suggestions.