Make sure the license group is right. In other words make sure you have the server licensed.  Also to search the errors .  index=_internal host=<"affectedhost">   sourcetype="splunk_web_service" source="splunkhome/var/log/splunk/web_service.log" ... View more

it worked for me the same way chown -R the shcluster directory.  ... View more