search

splunk / terraform-provider-splunk

Terraform Provider for Splunk
Mozilla Public License 2.0
103 stars 75 forks source link

splunk_apps_local throws error while creating apps from tar file #129

Open vj-joshi opened 2 years ago

vj-joshi commented 2 years ago

We are trying to create local apps using Splunk's terraform provider by passing a tar file but it fails with following error: Error: Unable to find resource: sre_test

Details: Splunk Provider version = "1.4.13" terraform version = "1.2.2"

Terraform block to create resource:

resource "splunk_apps_local" "splunk_sre_test_app" {
  filename          = true
  name              = "${path.module}/splunk_apps/sre_test.tar"
  explicit_appname  = "sre_test"
}

Folder structure:

tree splunk_apps/
splunk_apps/
├── sre_test
│   ├── app.conf
│   └── savedsearches.conf
└── sre_test.tar

Splunk Cloud Details:

Version: 8.2.2201.1
Experience: Victoria

Error while running tf apply: image

xenOs76 commented 1 year ago

Not sure if installing apps from files previously downloaded from Splunkbase applies to this case, but the same happens to me. 

terraform {
  required_providers {
    splunk = {
      source = "splunk/splunk"
      version = "1.4.12"
    }
  }
  required_version = "1.2.9"
}

resource "splunk_apps_local" "splunk_dashboard_examples" {
  name = "${path.module}/apps/splunk_dashboard_examples/splunk-dashboard-examples_825.tgz"
  filename = true
  explicit_appname = "Splunk_Dashboard_Examples"
}

When applying I get:

❯ terraform apply 
splunk_global_http_event_collector.http: Refreshing state... [id=http]
splunk_inputs_tcp_splunk_tcp_token.tcp_splunk_tcp_token: Refreshing state... [id=new-splunk-tcp-token]
splunk_inputs_tcp_cooked.tcp_cooked: Refreshing state... [id=5000]
splunk_inputs_tcp_raw.tcp_raw: Refreshing state... [id=5001]
splunk_indexes.test_index_01: Refreshing state... [id=test-index-01]
splunk_saved_searches.test_alert_presets_search: Refreshing state... [id=tfsplunk-alert-with-presets]

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # splunk_apps_local.splunk_dashboard_examples will be created
  + resource "splunk_apps_local" "splunk_dashboard_examples" {
      + author           = (known after apply)
      + configured       = (known after apply)
      + description      = (known after apply)
      + explicit_appname = "Splunk_Dashboard_Examples"
      + filename         = true
      + id               = (known after apply)
      + label            = (known after apply)
      + name             = "./apps/splunk_dashboard_examples/splunk-dashboard-examples_825.tgz"
      + version          = (known after apply)
      + visible          = (known after apply)

      + acl {
          + app              = (known after apply)
          + can_change_perms = (known after apply)
          + can_share_app    = (known after apply)
          + can_share_global = (known after apply)
          + can_share_user   = (known after apply)
          + can_write        = (known after apply)
          + owner            = (known after apply)
          + read             = (known after apply)
          + removable        = (known after apply)
          + sharing          = (known after apply)
          + write            = (known after apply)
        }
    }

Plan: 1 to add, 0 to change, 0 to destroy.

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

splunk_apps_local.splunk_dashboard_examples: Creating...
╷
│ Error: Unable to find resource: Splunk_Dashboard_Examples
│ 
│   with splunk_apps_local.splunk_dashboard_examples,
│   on main.tf line 114, in resource "splunk_apps_local" "splunk_dashboard_examples":
│  114: resource "splunk_apps_local" "splunk_dashboard_examples" {
│ 
╵

The server in an EC2 instance created from a Splunk AMI 9.0.0.
The logs show: 

- tfsplunk [14/Oct/2022:17:14:07.613 +0000] "POST /services/auth/login?count=-1&output_mode=json HTTP/1.1" 200 150 "-" "splunk-simple-go-client" - - - 5ms
- tfsplunk [14/Oct/2022:17:14:07.689 +0000] "POST /servicesNS/nobody/system/apps/local?count=-1&output_mode=json HTTP/1.1" 500 246 "-" "splunk-simple-go-client" - - - 0ms
- tfsplunk [14/Oct/2022:17:14:07.961 +0000] "GET /servicesNS/-/-/apps/local?count=-1&output_mode=json HTTP/1.1" 200 3289 "-" "splunk-simple-go-client" - - - 2ms
xenOs76 commented 1 year ago

if I update the resource using and existing folder name as explicit_appname the result differs:

resource "splunk_apps_local" "splunk_dashboard_examples" {
  name = "${path.module}/apps/splunk_dashboard_examples/splunk-dashboard-examples_825.tgzz"
  filename = true
  #explicit_appname = "Splunk_Dashboard_Examples"
  explicit_appname = "Splunk_TA_nginx"
}
❯ terraform state rm splunk_apps_local.splunk_dashboard_examples
Removed splunk_apps_local.splunk_dashboard_examples
Successfully removed 1 resource instance(s).

❯ terraform apply 
splunk_global_http_event_collector.http: Refreshing state... [id=http]
splunk_inputs_tcp_cooked.tcp_cooked: Refreshing state... [id=5000]
splunk_inputs_tcp_raw.tcp_raw: Refreshing state... [id=5001]
splunk_inputs_tcp_splunk_tcp_token.tcp_splunk_tcp_token: Refreshing state... [id=new-splunk-tcp-token]
splunk_indexes.test_index_01: Refreshing state... [id=test-index-01]
splunk_saved_searches.test_alert_presets_search: Refreshing state... [id=tfsplunk-alert-with-presets]

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # splunk_apps_local.splunk_dashboard_examples will be created
  + resource "splunk_apps_local" "splunk_dashboard_examples" {
      + author           = (known after apply)
      + configured       = (known after apply)
      + description      = (known after apply)
      + explicit_appname = "Splunk_TA_nginx"
      + filename         = true
      + id               = (known after apply)
      + label            = (known after apply)
      + name             = "./apps/splunk_dashboard_examples/splunk-dashboard-examples_825.tgzz"
      + version          = (known after apply)
      + visible          = (known after apply)

      + acl {
          + app              = (known after apply)
          + can_change_perms = (known after apply)
          + can_share_app    = (known after apply)
          + can_share_global = (known after apply)
          + can_share_user   = (known after apply)
          + can_write        = (known after apply)
          + owner            = (known after apply)
          + read             = (known after apply)
          + removable        = (known after apply)
          + sharing          = (known after apply)
          + write            = (known after apply)
        }
    }

Plan: 1 to add, 0 to change, 0 to destroy.

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

splunk_apps_local.splunk_dashboard_examples: Creating...
splunk_apps_local.splunk_dashboard_examples: Creation complete after 0s [id=Splunk_TA_nginx]

Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

When creating the new resource, even if the app the folder belongs to (Splunk Add-on for Nginx in this case) it is not subject to changes.
When I destroy splunk_apps_local.splunk_dashboard_examples the Splunk Add-on for Nginx gets uninstalled.

eyaltam71 commented 1 year ago

facing the same issue resource "splunk_apps_local" "google_importexport" { filename = true name = "${path.module}/apps/google-importexport_206.tgz" explicit_appname = "google_drive" }

error: 2022-12-11T19:52:46.462+0200 [DEBUG] provider: starting plugin: path=.terraform/providers/registry.terraform.io/splunk/splunk/1.4.17/darwin_arm64/terraform-provider-splunk_v1.4.17 args=[.terraform/providers/registry.terraform.io/splunk/splunk/1.4.17/darwin_arm64/terraform-provider-splunk_v1.4.17] 2022-12-11T19:52:46.464+0200 [DEBUG] provider: plugin started: path=.terraform/providers/registry.terraform.io/splunk/splunk/1.4.17/darwin_arm64/terraform-provider-splunk_v1.4.17 pid=7197 2022-12-11T19:52:46.464+0200 [DEBUG] provider: waiting for RPC address: path=.terraform/providers/registry.terraform.io/splunk/splunk/1.4.17/darwin_arm64/terraform-provider-splunk_v1.4.17 2022-12-11T19:52:46.474+0200 [INFO] provider.terraform-provider-splunk_v1.4.17: configuring server automatic mTLS: timestamp=2022-12-11T19:52:46.474+0200 2022-12-11T19:52:46.483+0200 [DEBUG] provider: using plugin: version=5 2022-12-11T19:52:46.483+0200 [DEBUG] provider.terraform-provider-splunk_v1.4.17: plugin address: address=/var/folders/tl/zqbl59b15r52dsj8jqsxg1qw0000gn/T/plugin2729436325 network=unix timestamp=2022-12-11T19:52:46.483+0200 2022-12-11T19:52:46.493+0200 [DEBUG] No provider meta schema returned 2022-12-11T19:52:46.497+0200 [WARN] ValidateProviderConfig from "provider[\"registry.terraform.io/splunk/splunk\"]" changed the config value, but that value is unused splunk_apps_local.google_importexport: Creating... 2022-12-11T19:52:47.346+0200 [INFO] Starting apply for splunk_apps_local.google_importexport 2022-12-11T19:52:47.346+0200 [DEBUG] splunk_apps_local.google_importexport: applying the planned Create change 2022-12-11T19:52:49.222+0200 [ERROR] vertex "splunk_apps_local.google_importexport" error: Unable to find resource: google_drive ╷ │ Error: Unable to find resource: google_drive │