After I installed the ES app, I got the error as shown in the attached picture.
On the ES upgrade page, I noticed it mentions about If you do not run the setup procedure promptly after the file upload completes, Enterprise Security displays errors.
To fix this, I restarted Splunk, but on the cli, it came up with a whole heap of errors, such as below, which is just an extract of the errors.
Invalid key in stanza [identityLookup] in /opt/splunk/etc/apps/SA-IdentityManagement/local/identityLookup.conf, line 6: eai:appName (value: SA-IdentityManagement).
Invalid key in stanza [identityLookup] in /opt/splunk/etc/apps/SA-IdentityManagement/local/identityLookup.conf, line 7: eai:userName (value: nobody).
Invalid key in stanza [nav_collection:ess_security_intelligence] in /opt/splunk/etc/apps/SplunkEnterpriseSecuritySuite/default/managed_configurations.conf, line 83: nav_collection_status (value: old).
Invalid key in stanza [nav_collection:ess_security_intelligence] in /opt/splunk/etc/apps/SplunkEnterpriseSecuritySuite/default/managed_configurations.conf, line 120: nav_collection_data (value:
UPDATE : additional info - Before this, I had just upgraded Splunk SH from 6.5.2 to 6.6.1. There was no issue after this upgrade.
Please advise how I can fix this.
Did you check the compatability of that version of ES with that version of Splunk?
after restarting, ES app just shows a blank page after clicking the "Set up" option.
Is this Linux or Windows? If Linux and the permissions were not set correctly you may have only partially upgraded and may be running a Frankenstein's ES at the moment. If it is as simple as that, a chown -R splunk:splunk /opt/splunk (assuming that's the account and location that match your environment) and a second attempt at install should fix things.
If not...
What does it say in Splunkd.log? Look for ERROR or WARN messages there. Also in $SPLUNK_HOME/var/log/splunk/ you should have a file called (if memory serves) ess2_installer.log or maybe ess_installer2.log, can you look there and post the last 100 lines or so?