Adding this because we ran into a similar problem (not the same upgrade version), but were able to resolve the issue.  KVStore wasn't liking our certificates so we stopped splunk, removed the server.pem file and the $SPLUNK_HOME/var/lib/splunk/kvstore/mongo/mongod.lock, and started Splunk. KVStore didn't like our cert and it fixed our issue. Hopefully it helps anyone else stumbling across this thread.  ... View more

This resolved it (issue with another app). A similar thing happened to me, the Splunk App for SOAR's configuration page was not loading all buttons on the configuration page.  We discovered that there was a passwords.conf file (in another app) that was not set correctly. It was pushed from another Splunk instance (the password was already hashed) which interfered with the passwords.conf in the Splunk App for SOAR. The splunkd error logs were essentially 1:1 which is how I found your post.  If anyone else stumbles upon this post (with similar errors), be sure to check the passwords.conf configurations - even in other apps. Hope this helps! ... View more