I am trying to run the following tstats search on indexer cluster, recently updated to splunk 8.2.1:     | tstats count where index=_internal by host       The search returns no results, I suspect that the reason is this message in search log of the indexer:     Mixed mode is disabled, skipping search for bucket with no TSIDX data: \opt\splunkhot\_internaldb\db\hot_v1_4334       When I check the specified bucket folder, I can see the tsidx files inside.  Interesting fact is, that this issue occurs only with _internal index, same command works fine with other indexes. I have datamodel "Splunk's Internal Server Logs" enabled and accelerated. Any suggestions where to start troubleshooting this issue? ... View more

We made a clean installation of on-prem Splunk Enterprise 8.0.9 and Enterprise Security 6.4.0. When correlation search returns results, we would like to append these results to an email via adaptive response action "Send Email".  We had selected the option to include an inline-table, but regardless of this setting, the table with results is still not added to the email. There are two additional  findings we discovered: If we try to append results of standard alert search (non-correlation search) to an email it works. If we set sendresults = 1 in $SPLUNK_HOME/etc/system/local/alert_actions.conf it also works but not for all correlation searches... Has anybody encountered such problems and how did you solve it? ... View more