I first time installing ES apps on Splunk Enterprise 7.2.1 with ES version 5.2.0.
1 SH standalone
3 Indexer in Cluster mode
Installation of ES apps
1.Installation of ES done successfully ,But not able to see any data over ES dashboard.
2.All ES data-models are accelerated.
3.No event is in notable event
What ES dashboard? The security posture?
Have you enabled or created correlation searches that have alert actions as create notable events? If not, then you can't expect dashboards based on notables if they don't exist yet.
Let us know
I'm assuming by your saying there's no data on the dashboard, there's no data on any of them? Your "all ES datamodels are accelerated" comment kind of tips me off, as it's not too common to see an environment where they all are.
There's kind of a lot to go through here, and I don't know how familiar you are with Splunk or its mechanisms, so I'll start at the baseline.
Do you know if your data is CIM-compliant? You can get an overview of CIM, the Common Information Model, here: https://docs.splunk.com/Documentation/CIM/4.12.0/User/Overview
ES dashboards are populated by searches based - mostly - on the summaries created by accelerated data models. But the acceleration of that data is dependent on the data being normalized to that Common Information Model.
Try this. Datamodel summaries - what model accelerations create - are generated by underlying searches. Those searches look something like this:
Take any of those models, and run their searches ad-hoc. Do you get results? If not, they're probably not CIM compliant, or you just don't have the data applicable to that model. Or both.
What do you mean by
installing ES apps? Do you mean
installing ES? Do you mean installing
TAs? Who setup you ES; did you do it yourself or did you get PS?