I have tried to enable the [SSL] and [splunktcp-ssl:9998] stanzas in Splunk while running Splunk in FIPS and the port 9998 doesn't show up in netstat. While running the same configurations on a non FIPS instance works without any issue. I can get the Splunk FIPS version to listen on a port as long as I am not using the two stanzas [SSL] and [splunktcp-ssl:9998] and instead using the default stanza [splunktcp://9997].
The splunkd.log was showing invalid password or certificate not found. The same settings were used on a Splunk instance without FIPS with the same settings and was working. To fix the issue though I created now SSL certs, but still was not able to identify the root cause. I used the following steps in the splunk documentation to create new SSL certs to get this working in FIPS mode.