Open vj-joshi opened 2 years ago
Not sure if installing apps from files previously downloaded from Splunkbase applies to this case, but the same happens to me.
terraform {
required_providers {
splunk = {
source = "splunk/splunk"
version = "1.4.12"
}
}
required_version = "1.2.9"
}
resource "splunk_apps_local" "splunk_dashboard_examples" {
name = "${path.module}/apps/splunk_dashboard_examples/splunk-dashboard-examples_825.tgz"
filename = true
explicit_appname = "Splunk_Dashboard_Examples"
}
When applying I get:
❯ terraform apply
splunk_global_http_event_collector.http: Refreshing state... [id=http]
splunk_inputs_tcp_splunk_tcp_token.tcp_splunk_tcp_token: Refreshing state... [id=new-splunk-tcp-token]
splunk_inputs_tcp_cooked.tcp_cooked: Refreshing state... [id=5000]
splunk_inputs_tcp_raw.tcp_raw: Refreshing state... [id=5001]
splunk_indexes.test_index_01: Refreshing state... [id=test-index-01]
splunk_saved_searches.test_alert_presets_search: Refreshing state... [id=tfsplunk-alert-with-presets]
Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
+ create
Terraform will perform the following actions:
# splunk_apps_local.splunk_dashboard_examples will be created
+ resource "splunk_apps_local" "splunk_dashboard_examples" {
+ author = (known after apply)
+ configured = (known after apply)
+ description = (known after apply)
+ explicit_appname = "Splunk_Dashboard_Examples"
+ filename = true
+ id = (known after apply)
+ label = (known after apply)
+ name = "./apps/splunk_dashboard_examples/splunk-dashboard-examples_825.tgz"
+ version = (known after apply)
+ visible = (known after apply)
+ acl {
+ app = (known after apply)
+ can_change_perms = (known after apply)
+ can_share_app = (known after apply)
+ can_share_global = (known after apply)
+ can_share_user = (known after apply)
+ can_write = (known after apply)
+ owner = (known after apply)
+ read = (known after apply)
+ removable = (known after apply)
+ sharing = (known after apply)
+ write = (known after apply)
}
}
Plan: 1 to add, 0 to change, 0 to destroy.
Do you want to perform these actions?
Terraform will perform the actions described above.
Only 'yes' will be accepted to approve.
Enter a value: yes
splunk_apps_local.splunk_dashboard_examples: Creating...
╷
│ Error: Unable to find resource: Splunk_Dashboard_Examples
│
│ with splunk_apps_local.splunk_dashboard_examples,
│ on main.tf line 114, in resource "splunk_apps_local" "splunk_dashboard_examples":
│ 114: resource "splunk_apps_local" "splunk_dashboard_examples" {
│
╵
The server in an EC2 instance created from a Splunk AMI 9.0.0.
The logs show:
- tfsplunk [14/Oct/2022:17:14:07.613 +0000] "POST /services/auth/login?count=-1&output_mode=json HTTP/1.1" 200 150 "-" "splunk-simple-go-client" - - - 5ms
- tfsplunk [14/Oct/2022:17:14:07.689 +0000] "POST /servicesNS/nobody/system/apps/local?count=-1&output_mode=json HTTP/1.1" 500 246 "-" "splunk-simple-go-client" - - - 0ms
- tfsplunk [14/Oct/2022:17:14:07.961 +0000] "GET /servicesNS/-/-/apps/local?count=-1&output_mode=json HTTP/1.1" 200 3289 "-" "splunk-simple-go-client" - - - 2ms
if I update the resource
using and existing folder name as explicit_appname
the result differs:
resource "splunk_apps_local" "splunk_dashboard_examples" {
name = "${path.module}/apps/splunk_dashboard_examples/splunk-dashboard-examples_825.tgzz"
filename = true
#explicit_appname = "Splunk_Dashboard_Examples"
explicit_appname = "Splunk_TA_nginx"
}
❯ terraform state rm splunk_apps_local.splunk_dashboard_examples
Removed splunk_apps_local.splunk_dashboard_examples
Successfully removed 1 resource instance(s).
❯ terraform apply
splunk_global_http_event_collector.http: Refreshing state... [id=http]
splunk_inputs_tcp_cooked.tcp_cooked: Refreshing state... [id=5000]
splunk_inputs_tcp_raw.tcp_raw: Refreshing state... [id=5001]
splunk_inputs_tcp_splunk_tcp_token.tcp_splunk_tcp_token: Refreshing state... [id=new-splunk-tcp-token]
splunk_indexes.test_index_01: Refreshing state... [id=test-index-01]
splunk_saved_searches.test_alert_presets_search: Refreshing state... [id=tfsplunk-alert-with-presets]
Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
+ create
Terraform will perform the following actions:
# splunk_apps_local.splunk_dashboard_examples will be created
+ resource "splunk_apps_local" "splunk_dashboard_examples" {
+ author = (known after apply)
+ configured = (known after apply)
+ description = (known after apply)
+ explicit_appname = "Splunk_TA_nginx"
+ filename = true
+ id = (known after apply)
+ label = (known after apply)
+ name = "./apps/splunk_dashboard_examples/splunk-dashboard-examples_825.tgzz"
+ version = (known after apply)
+ visible = (known after apply)
+ acl {
+ app = (known after apply)
+ can_change_perms = (known after apply)
+ can_share_app = (known after apply)
+ can_share_global = (known after apply)
+ can_share_user = (known after apply)
+ can_write = (known after apply)
+ owner = (known after apply)
+ read = (known after apply)
+ removable = (known after apply)
+ sharing = (known after apply)
+ write = (known after apply)
}
}
Plan: 1 to add, 0 to change, 0 to destroy.
Do you want to perform these actions?
Terraform will perform the actions described above.
Only 'yes' will be accepted to approve.
Enter a value: yes
splunk_apps_local.splunk_dashboard_examples: Creating...
splunk_apps_local.splunk_dashboard_examples: Creation complete after 0s [id=Splunk_TA_nginx]
Apply complete! Resources: 1 added, 0 changed, 0 destroyed.
When creating the new resource, even if the app the folder belongs to (Splunk Add-on for Nginx in this case) it is not subject to changes.
When I destroy splunk_apps_local.splunk_dashboard_examples
the Splunk Add-on for Nginx gets uninstalled.
facing the same issue resource "splunk_apps_local" "google_importexport" { filename = true name = "${path.module}/apps/google-importexport_206.tgz" explicit_appname = "google_drive" }
error: 2022-12-11T19:52:46.462+0200 [DEBUG] provider: starting plugin: path=.terraform/providers/registry.terraform.io/splunk/splunk/1.4.17/darwin_arm64/terraform-provider-splunk_v1.4.17 args=[.terraform/providers/registry.terraform.io/splunk/splunk/1.4.17/darwin_arm64/terraform-provider-splunk_v1.4.17] 2022-12-11T19:52:46.464+0200 [DEBUG] provider: plugin started: path=.terraform/providers/registry.terraform.io/splunk/splunk/1.4.17/darwin_arm64/terraform-provider-splunk_v1.4.17 pid=7197 2022-12-11T19:52:46.464+0200 [DEBUG] provider: waiting for RPC address: path=.terraform/providers/registry.terraform.io/splunk/splunk/1.4.17/darwin_arm64/terraform-provider-splunk_v1.4.17 2022-12-11T19:52:46.474+0200 [INFO] provider.terraform-provider-splunk_v1.4.17: configuring server automatic mTLS: timestamp=2022-12-11T19:52:46.474+0200 2022-12-11T19:52:46.483+0200 [DEBUG] provider: using plugin: version=5 2022-12-11T19:52:46.483+0200 [DEBUG] provider.terraform-provider-splunk_v1.4.17: plugin address: address=/var/folders/tl/zqbl59b15r52dsj8jqsxg1qw0000gn/T/plugin2729436325 network=unix timestamp=2022-12-11T19:52:46.483+0200 2022-12-11T19:52:46.493+0200 [DEBUG] No provider meta schema returned 2022-12-11T19:52:46.497+0200 [WARN] ValidateProviderConfig from "provider[\"registry.terraform.io/splunk/splunk\"]" changed the config value, but that value is unused splunk_apps_local.google_importexport: Creating... 2022-12-11T19:52:47.346+0200 [INFO] Starting apply for splunk_apps_local.google_importexport 2022-12-11T19:52:47.346+0200 [DEBUG] splunk_apps_local.google_importexport: applying the planned Create change 2022-12-11T19:52:49.222+0200 [ERROR] vertex "splunk_apps_local.google_importexport" error: Unable to find resource: google_drive ╷ │ Error: Unable to find resource: google_drive │
We are trying to create local apps using Splunk's terraform provider by passing a tar file but it fails with following error:
Error: Unable to find resource: sre_test
Details: Splunk Provider version = "1.4.13" terraform version = "1.2.2"
Terraform block to create resource:
Folder structure:
Splunk Cloud Details:
Error while running tf apply:![image](https://user-images.githubusercontent.com/107563950/173853926-7a7cda5a-c844-4641-a7f5-42e085c361d4.png)