Hunting an APT with Splunk - Reconnaissance

[lorraine]

Hello!
I am new to Splunk and attempting the BOTS workshop, Hunting an APT with Splunk - Reconnaissance, and have encountered an issue.
Following the video, I tried to access the identity centre, asset centre and the Frothly environment network diagram.
However none of these are working for me.
The Frothly environment shows a blank screen.
The Identity and Asset centres show an error in 'inputlookup' command: External command based lookup 'identity_lookup_expanded is not available because KV store initialisation has failed.
Does anyone have any idea how to get around this, or has anyone else encountered this error?

[kprior201]

If the KVStore initialization has failed, you'll definitely have a lot of issues. You'll need to figure out why that is by looking through $SPLUNK_HOME/var/log/splunk/mongod.log to see what's going on there and address it first.