Your default index ("main") is indeed disabled, as advertised by the error message you get on start-up :
system [main]
(...)
system defaultDatabase = main
system disabled = 1 <=====
system enableRealtimeSearch = true
(...)
Since the disabled = 1 directive comes from $SPLUNK_HOME/etc/system/local/indexes.conf , I would assume that this is caused by a collision in the bucket IDs in that index. In such a situation, Splunk will automatically disable the index on start-up, which is fatal for the default index.
If this is indeed the issue you are encountering, you should be able to fix it by following the instructions listed in this Splunk Answer.
Note that it's quite likely that other indexes which exist by default ( _internal , _audit , summary ...) may have the same issue, so I would recommend to check those for bucket collisions before re-enabling all disabled indexes in $SPLUNK_HOME/etc/system/local/indexes.conf and attempting to start again.
Let us know if it works!
Update: The general procedure to resolve bucket collisions in a given index goes as follows :
stop splunkd
determine the lowest available bucket ID in the affected index
for each pair of conflicting buckets, pick one of the buckets and change its bucket ID to the next available bucket ID by renaming its directory
once you are certain that no bucket ID is shared by two buckets, start splunkd
... View more
