Why am I getting "ERROR UiPythonFallback - Appserver at http://127.0.0.1:8065 never started up!" on my Splunk 6.2.1 indexers?

[richardwii]

I am new to Splunk, and noticed the web interface for my Indexers is offline.

After reviewing the logs I found the below error messages:

ERROR UiPythonFallback - Appserver at http://127.0.0.1:8065 never started up!
ERROR UiPythonFallback - Couldn't start any appserver processes, UI will probably not function correctly!

Initially there was a duplicate application error, with a _cluster directory present in different app directories.
Following the answers to another question I clean all of _cluster directories up.

This does not impact my heavy forwarders, only the indexers.
I'm using a RHEL VP on AWS running Splunk 6.2.1

Any help would be greatly appreciated.

Thanks in Advance
Richard

[matthewpearce]

I was stuck on this error for a long time. When I removed the last application that I installed from /apps/splunk/etc/apps/ and restarted splunk, it came up fine. I suspect there was an issue with the latest App that I tried to install. Manually removing and restarting seemed to fix it.

[ThomasKoeberlei]

If your AWS machine is offline, this could help:
splunk-launch.conf:

QUICKDRAW_URL=0

https://answers.splunk.com/answers/545000/slow-splunkweb-startup-caused-by-splunk-instrument.html

[briancrandall]

I ran into a similar set of errors in my AWS logs. When I tried to connect to the web interface, I would get a response of "500 No appservers running." The root cause turned out to be auditd hogging disk I/O. Not sure if you have the same issue, but you might try disabling the auditd service and see if that does anything.