Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Cannot import already existing saved_searches #179

Open
HarryBo112 opened this issue Nov 1, 2023 · 2 comments
Open

Cannot import already existing saved_searches #179

HarryBo112 opened this issue Nov 1, 2023 · 2 comments

Comments

@HarryBo112
Copy link

HarryBo112 commented Nov 1, 2023 •
edited
Loading

Hello!
I am using TF 1.6.2 with the Splunk Provider 1.4.22.

I want to import existing notifications / reports / "saved_searches", but it fails with 404.

For testing purposes I've also created a notification via TF named "TestCr", but also this cannot be re-imported:

Created with:

resource "splunk_saved_searches" "saved_search_3" { name = "TestCr" search = "index=jds-globit-logs-long" actions = "email" action_email_format = "table" action_email_max_time = "5m" action_email_max_results = 10 action_email_send_results = false action_email_subject = "Splunk Alert: $name$" action_email_to = "[email protected]" action_email_track_alert = true dispatch_earliest_time = "-15m" dispatch_latest_time = "-0m" alert_type = "number of events" alert_comparator = "greater than" alert_threshold = 100 cron_schedule = "*/6 * * * *" is_scheduled = true acl { sharing = "app" app = "foo-app" owner="foo-user } }

I try to import the existing notifications via:

import { to = splunk_saved_searches.my_test_cr id = "TestCr" }

Which then returns 404:

`
2023-11-01T09:00:52.618+0100 [INFO] Terraform version: 1.6.2
2023-11-01T09:00:52.618+0100 [DEBUG] using github.com/hashicorp/go-tfe v1.36.0
2023-11-01T09:00:52.618+0100 [DEBUG] using github.com/hashicorp/hcl/v2 v2.19.1
2023-11-01T09:00:52.618+0100 [DEBUG] using github.com/hashicorp/terraform-svchost v0.1.1
2023-11-01T09:00:52.618+0100 [DEBUG] using github.com/zclconf/go-cty v1.14.1
2023-11-01T09:00:52.618+0100 [INFO] Go runtime version: go1.21.1
2023-11-01T09:00:52.618+0100 [INFO] CLI args: []string{"terraform-1.6.2", "plan", "-generate-config-out=generated_resources2.tf"}
2023-11-01T09:00:52.618+0100 [DEBUG] Attempting to open CLI config file: /home/USER/.terraformrc
2023-11-01T09:00:52.618+0100 [DEBUG] File doesn't exist, but doesn't need to. Ignoring.
2023-11-01T09:00:52.618+0100 [DEBUG] ignoring non-existing provider search directory terraform.d/plugins
2023-11-01T09:00:52.618+0100 [DEBUG] ignoring non-existing provider search directory /home/USER/.terraform.d/plugins
2023-11-01T09:00:52.618+0100 [DEBUG] ignoring non-existing provider search directory /home/USER/.local/share/terraform/plugins
2023-11-01T09:00:52.618+0100 [DEBUG] ignoring non-existing provider search directory /usr/share/plasma/terraform/plugins
2023-11-01T09:00:52.618+0100 [DEBUG] ignoring non-existing provider search directory /usr/local/share/terraform/plugins
2023-11-01T09:00:52.618+0100 [DEBUG] ignoring non-existing provider search directory /usr/share/terraform/plugins
2023-11-01T09:00:52.618+0100 [INFO] CLI command args: []string{"plan", "-generate-config-out=generated_resources2.tf"}
2023-11-01T09:00:52.619+0100 [DEBUG] New state was assigned lineage "9195da90-d2ec-736c-ea63-112"
2023-11-01T09:00:52.660+0100 [DEBUG] checking for provisioner in "."
2023-11-01T09:00:52.661+0100 [DEBUG] checking for provisioner in "/home/USER/programs"
2023-11-01T09:00:52.661+0100 [INFO] backend/local: starting Plan operation
2023-11-01T09:00:52.663+0100 [DEBUG] created provider logger: level=debug
2023-11-01T09:00:52.663+0100 [INFO] provider: configuring client automatic mTLS
2023-11-01T09:00:52.672+0100 [DEBUG] provider: starting plugin: path=.terraform/providers/registry.terraform.io/splunk/splunk/1.4.22/linux_amd64/terraform-provider-splunk_v1.4.22 args=[".terraform/providers/registry.terraform.io/splunk/splunk/1.4.22/linux_amd64/terraform-provider-splunk_v1.4.22"]
2023-11-01T09:00:52.673+0100 [DEBUG] provider: plugin started: path=.terraform/providers/registry.terraform.io/splunk/splunk/1.4.22/linux_amd64/terraform-provider-splunk_v1.4.22 pid=61374
2023-11-01T09:00:52.673+0100 [DEBUG] provider: waiting for RPC address: path=.terraform/providers/registry.terraform.io/splunk/splunk/1.4.22/linux_amd64/terraform-provider-splunk_v1.4.22
2023-11-01T09:00:52.679+0100 [INFO] provider.terraform-provider-splunk_v1.4.22: configuring server automatic mTLS: timestamp="2023-11-01T09:00:52.679+0100"
2023-11-01T09:00:52.686+0100 [DEBUG] provider: using plugin: version=5
2023-11-01T09:00:52.686+0100 [DEBUG] provider.terraform-provider-splunk_v1.4.22: plugin address: address=/tmp/plugin2171921060 network=unix timestamp="2023-11-01T09:00:52.686+0100"
2023-11-01T09:00:52.695+0100 [DEBUG] No provider meta schema returned
2023-11-01T09:00:52.697+0100 [DEBUG] provider.stdio: received EOF, stopping recv loop: err="rpc error: code = Unavailable desc = error reading from server: EOF"
2023-11-01T09:00:52.697+0100 [DEBUG] provider: plugin process exited: path=.terraform/providers/registry.terraform.io/splunk/splunk/1.4.22/linux_amd64/terraform-provider-splunk_v1.4.22 pid=61374
2023-11-01T09:00:52.697+0100 [DEBUG] provider: plugin exited
2023-11-01T09:00:52.697+0100 [DEBUG] Building and walking validate graph
2023-11-01T09:00:52.697+0100 [DEBUG] ProviderTransformer: "splunk_saved_searches.saved_search_3" (*terraform.NodeValidatableResource) needs provider["registry.terraform.io/splunk/splunk"]
2023-11-01T09:00:52.698+0100 [DEBUG] ReferenceTransformer: "provider["registry.terraform.io/splunk/splunk"]" references: []
2023-11-01T09:00:52.698+0100 [DEBUG] ReferenceTransformer: "splunk_saved_searches.saved_search_3" references: []
2023-11-01T09:00:52.699+0100 [DEBUG] Starting graph walk: walkValidate
2023-11-01T09:00:52.699+0100 [DEBUG] created provider logger: level=debug
2023-11-01T09:00:52.699+0100 [INFO] provider: configuring client automatic mTLS
2023-11-01T09:00:52.702+0100 [DEBUG] provider: starting plugin: path=.terraform/providers/registry.terraform.io/splunk/splunk/1.4.22/linux_amd64/terraform-provider-splunk_v1.4.22 args=[".terraform/providers/registry.terraform.io/splunk/splunk/1.4.22/linux_amd64/terraform-provider-splunk_v1.4.22"]
2023-11-01T09:00:52.703+0100 [DEBUG] provider: plugin started: path=.terraform/providers/registry.terraform.io/splunk/splunk/1.4.22/linux_amd64/terraform-provider-splunk_v1.4.22 pid=61387
2023-11-01T09:00:52.703+0100 [DEBUG] provider: waiting for RPC address: path=.terraform/providers/registry.terraform.io/splunk/splunk/1.4.22/linux_amd64/terraform-provider-splunk_v1.4.22
2023-11-01T09:00:52.708+0100 [INFO] provider.terraform-provider-splunk_v1.4.22: configuring server automatic mTLS: timestamp="2023-11-01T09:00:52.708+0100"
2023-11-01T09:00:52.715+0100 [DEBUG] provider.terraform-provider-splunk_v1.4.22: plugin address: network=unix address=/tmp/plugin3458938686 timestamp="2023-11-01T09:00:52.715+0100"
2023-11-01T09:00:52.715+0100 [DEBUG] provider: using plugin: version=5
2023-11-01T09:00:52.724+0100 [DEBUG] No provider meta schema returned
2023-11-01T09:00:52.726+0100 [DEBUG] provider.stdio: received EOF, stopping recv loop: err="rpc error: code = Unavailable desc = error reading from server: EOF"
2023-11-01T09:00:52.727+0100 [DEBUG] provider: plugin process exited: path=.terraform/providers/registry.terraform.io/splunk/splunk/1.4.22/linux_amd64/terraform-provider-splunk_v1.4.22 pid=61387
2023-11-01T09:00:52.727+0100 [DEBUG] provider: plugin exited
2023-11-01T09:00:52.727+0100 [INFO] backend/local: plan calling Plan
2023-11-01T09:00:52.727+0100 [DEBUG] Building and walking plan graph for NormalMode
2023-11-01T09:00:52.727+0100 [DEBUG] ProviderTransformer: "splunk_saved_searches.saved_search_3 (expand)" (*terraform.nodeExpandPlannableResource) needs provider["registry.terraform.io/splunk/splunk"]
2023-11-01T09:00:52.727+0100 [DEBUG] ProviderTransformer: "splunk_saved_searches.canary (expand)" (*terraform.nodeExpandPlannableResource) needs provider["registry.terraform.io/splunk/splunk"]
2023-11-01T09:00:52.728+0100 [DEBUG] ReferenceTransformer: "splunk_saved_searches.saved_search_3 (expand)" references: []
2023-11-01T09:00:52.728+0100 [DEBUG] ReferenceTransformer: "splunk_saved_searches.canary (expand)" references: []
2023-11-01T09:00:52.728+0100 [DEBUG] ReferenceTransformer: "provider["registry.terraform.io/splunk/splunk"]" references: []
2023-11-01T09:00:52.728+0100 [DEBUG] Starting graph walk: walkPlan
2023-11-01T09:00:52.728+0100 [DEBUG] created provider logger: level=debug
2023-11-01T09:00:52.728+0100 [INFO] provider: configuring client automatic mTLS
2023-11-01T09:00:52.732+0100 [DEBUG] provider: starting plugin: path=.terraform/providers/registry.terraform.io/splunk/splunk/1.4.22/linux_amd64/terraform-provider-splunk_v1.4.22 args=[".terraform/providers/registry.terraform.io/splunk/splunk/1.4.22/linux_amd64/terraform-provider-splunk_v1.4.22"]
2023-11-01T09:00:52.732+0100 [DEBUG] provider: plugin started: path=.terraform/providers/registry.terraform.io/splunk/splunk/1.4.22/linux_amd64/terraform-provider-splunk_v1.4.22 pid=61399
2023-11-01T09:00:52.732+0100 [DEBUG] provider: waiting for RPC address: path=.terraform/providers/registry.terraform.io/splunk/splunk/1.4.22/linux_amd64/terraform-provider-splunk_v1.4.22
2023-11-01T09:00:52.737+0100 [INFO] provider.terraform-provider-splunk_v1.4.22: configuring server automatic mTLS: timestamp="2023-11-01T09:00:52.737+0100"
2023-11-01T09:00:52.745+0100 [DEBUG] provider: using plugin: version=5
2023-11-01T09:00:52.745+0100 [DEBUG] provider.terraform-provider-splunk_v1.4.22: plugin address: address=/tmp/plugin2571514896 network=unix timestamp="2023-11-01T09:00:52.745+0100"
2023-11-01T09:00:52.755+0100 [DEBUG] No provider meta schema returned
2023-11-01T09:00:52.759+0100 [WARN] ValidateProviderConfig from "provider["registry.terraform.io/splunk/splunk"]" changed the config value, but that value is unused
2023-11-01T09:00:52.855+0100 [DEBUG] ReferenceTransformer: "splunk_saved_searches.saved_search_3" references: []
2023-11-01T09:00:52.855+0100 [DEBUG] Resource instance state not found for node "splunk_saved_searches.canary", instance splunk_saved_searches.canary
2023-11-01T09:00:52.855+0100 [DEBUG] ReferenceTransformer: "splunk_saved_searches.canary" references: []
splunk_saved_searches.canary: Preparing import... [id=TestCr]
splunk_saved_searches.canary: Refreshing state... [id=TestCr]
splunk_saved_searches.saved_search_3: Refreshing state... [id=TestCr]
2023-11-01T09:00:52.881+0100 [ERROR] vertex "splunk_saved_searches.canary" error: 404 Not Found: {"messages":[{"type":"ERROR","text":"Could not find object id=TestCr"}]}
2023-11-01T09:00:52.881+0100 [ERROR] vertex "splunk_saved_searches.canary (expand)" error: 404 Not Found: {"messages":[{"type":"ERROR","text":"Could not find object id=TestCr"}]}
2023-11-01T09:00:52.915+0100 [WARN] Provider "registry.terraform.io/splunk/splunk" produced an invalid plan for splunk_saved_searches.saved_search_3, but we are tolerating it because it is using the legacy plugin SDK.
The following problems may be the cause of any confusing errors from downstream operations:
- .action_create_xsoar_incident_param_server_url: planned value cty.StringVal("") for a non-computed attribute
- .action_create_xsoar_incident_param_details: planned value cty.StringVal("") for a non-computed attribute
- .action_jira_service_desk_param_jira_priority: planned value cty.StringVal("") for a non-computed attribute
- .action_jira_service_desk_param_jira_project: planned value cty.StringVal("") for a non-computed attribute
- .action_create_xsoar_incident_param_custom_fields: planned value cty.StringVal("") for a non-computed attribute
- .action_jira_service_desk_param_jira_summary: planned value cty.StringVal("") for a non-computed attribute
- .action_create_xsoar_incident_param_type: planned value cty.StringVal("") for a non-computed attribute
- .is_visible: planned value cty.True for a non-computed attribute
- .action_pagerduty_integration_url: planned value cty.StringVal("") for a non-computed attribute
- .action_slack_param_fields: planned value cty.StringVal("") for a non-computed attribute
- .action_jira_service_desk_param_jira_description: planned value cty.StringVal("") for a non-computed attribute
- .action_slack_param_message: planned value cty.StringVal("") for a non-computed attribute
- .action_jira_service_desk_param_account: planned value cty.StringVal("") for a non-computed attribute
- .action_jira_service_desk_param_jira_issue_type: planned value cty.StringVal("") for a non-computed attribute
- .action_create_xsoar_incident_param_severity: planned value cty.StringVal("") for a non-computed attribute
- .action_create_xsoar_incident_param_incident_name: planned value cty.StringVal("") for a non-computed attribute
- .action_webhook_param_url: planned value cty.StringVal("") for a non-computed attribute
- .action_create_xsoar_incident_param_occurred: planned value cty.StringVal("") for a non-computed attribute
- .action_slack_param_webhook_url_override: planned value cty.StringVal("") for a non-computed attribute
- .action_create_xsoar_incident_param_send_all_servers: planned value cty.StringVal("") for a non-computed attribute
- .action_create_xsoar_incident: planned value cty.StringVal("") for a non-computed attribute
- .action_slack_param_channel: planned value cty.StringVal("") for a non-computed attribute
- .action_slack_param_attachment: planned value cty.StringVal("none") for a non-computed attribute
2023-11-01T09:00:52.919+0100 [INFO] backend/local: plan operation completed

Planning failed. Terraform encountered an error while generating this plan.

╷
│ Error: 404 Not Found: {"messages":[{"type":"ERROR","text":"Could not find object id=TestCr"}]}
`

This should import the notification, shouldn't it?

Regards!
@DaraDadachanji
Copy link

I am also having this issue

@RamanVaskevich1984
Copy link

RamanVaskevich1984 commented Jan 15, 2025 •
edited
Loading

Is this something permissions related to access Splunk Rest API?
I am also having this issue with Import:

terraform import 'module.splunk_alerts.splunk_saved_searches.alert["[TEAM] BRIX_NNMi_Windstream_Debit_Access_Ping_Test"]' /servicesNS/nobody/search/saved/searches/[TEAM]%20BRIX_NNMi_Windstream_Debit_Access_Ping_Test
module.splunk_alerts.splunk_saved_searches.alert["[TEAM] BRIX_NNMi_Windstream_Debit_Access_Ping_Test"]: Importing from ID "/servicesNS/nobody/search/saved/searches/[TEAM]%20BRIX_NNMi_Windstream_Debit_Access_Ping_Test"...
module.splunk_alerts.splunk_saved_searches.alert["[TEAM] BRIX_NNMi_Windstream_Debit_Access_Ping_Test"]: Import prepared!
Prepared splunk_saved_searches for import
module.splunk_alerts.splunk_saved_searches.alert["[TEAM] BRIX_NNMi_Windstream_Debit_Access_Ping_Test"]: Refreshing state... [id=/servicesNS/nobody/search/saved/searches/[TEAM]%20BRIX_NNMi_Windstream_Debit_Access_Ping_Test]
╷
│ Error: 404 Not Found: {"messages":[{"type":"ERROR","text":"Invalid custom action for this internal handler (handler: savedsearch, custom action: nobody, eai action: list)."}]}
│

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@DaraDadachanji @RamanVaskevich1984 @HarryBo112