Hi @Rayees , I don't know your search, but if it' something like this: <your_search> | timechart span=1h count BY host you have to add the outputcsv at the end of your search: <your_search> earliest=-24h@h latest=@h | timechart span=1h count BY host | outputcsv your_csv_file.csv and save it as an alert scheduled e.g. at 1 AM in [Save As > Alert > Run every day > Run at 1.00 > Save]  In this way you'll have the file in the $SPLUNK_HOME\var\run\splunk\csv folder, so you can schedule a shell script to move it in another folder. Ciao. Giuseppe   ... View more