You can check /opt/splunk/var/log/splunk/web_service.log to find what prevents the web interface to start.
Actually you do not need web interface on clustered indexer, it is better disabling it on web.conf.
You can send this config as an app from Cluster Master;
startwebserver = false
View solution in original post