How can we format a report and FTP it to a certain host?

[ddrillic]

We have an internal client which would like to run a report on an hourly basis and ftp the results of the report to a certain host. Is it possible? They are also wondering about the possible ways to format the report...

[somesoni2 · Accepted solution]

I don't believe there is any native method available. For similar requirements, we setup custom script to be executed as alert action for the report, which can access the search result as 8th parameter which Splunk passes it by default. Based on the language you select for writing that script (perl, python), there may be options to process the search result (gzip file), format it and scp it to accessible places.

[ddrillic]

Gorgeous @somesoni2 - can you please convert to an answer?

[somesoni2]

Here you go.