Cannot import already existing saved_searches

Hello! I am using TF 1.6.2 with the Splunk Provider 1.4.22.

I want to import existing notifications / reports / "saved_searches", but it fails with 404.

For testing purposes I've also created a notification via TF named "TestCr", but also this cannot be re-imported:

Created with:

resource "splunk_saved_searches" "saved_search_3" { name = "TestCr" search = "index=jds-globit-logs-long" actions = "email" action_email_format = "table" action_email_max_time = "5m" action_email_max_results = 10 action_email_send_results = false action_email_subject = "Splunk Alert: $name$" action_email_to = "foo@bar.com" action_email_track_alert = true dispatch_earliest_time = "-15m" dispatch_latest_time = "-0m" alert_type = "number of events" alert_comparator = "greater than" alert_threshold = 100 cron_schedule = "*/6 * * * *" is_scheduled = true acl { sharing = "app" app = "foo-app" owner="foo-user } }

I try to import the existing notifications via:

import { to = splunk_saved_searches.my_test_cr id = "TestCr" }

Which then returns 404:

` 2023-11-01T09:00:52.618+0100 [INFO] Terraform version: 1.6.2 2023-11-01T09:00:52.618+0100 [DEBUG] using github.com/hashicorp/go-tfe v1.36.0 2023-11-01T09:00:52.618+0100 [DEBUG] using github.com/hashicorp/hcl/v2 v2.19.1 2023-11-01T09:00:52.618+0100 [DEBUG] using github.com/hashicorp/terraform-svchost v0.1.1 2023-11-01T09:00:52.618+0100 [DEBUG] using github.com/zclconf/go-cty v1.14.1 2023-11-01T09:00:52.618+0100 [INFO] Go runtime version: go1.21.1 2023-11-01T09:00:52.618+0100 [INFO] CLI args: []string{"terraform-1.6.2", "plan", "-generate-config-out=generated_resources2.tf"} 2023-11-01T09:00:52.618+0100 [DEBUG] Attempting to open CLI config file: /home/USER/.terraformrc 2023-11-01T09:00:52.618+0100 [DEBUG] File doesn't exist, but doesn't need to. Ignoring. 2023-11-01T09:00:52.618+0100 [DEBUG] ignoring non-existing provider search directory terraform.d/plugins 2023-11-01T09:00:52.618+0100 [DEBUG] ignoring non-existing provider search directory /home/USER/.terraform.d/plugins 2023-11-01T09:00:52.618+0100 [DEBUG] ignoring non-existing provider search directory /home/USER/.local/share/terraform/plugins 2023-11-01T09:00:52.618+0100 [DEBUG] ignoring non-existing provider search directory /usr/share/plasma/terraform/plugins 2023-11-01T09:00:52.618+0100 [DEBUG] ignoring non-existing provider search directory /usr/local/share/terraform/plugins 2023-11-01T09:00:52.618+0100 [DEBUG] ignoring non-existing provider search directory /usr/share/terraform/plugins 2023-11-01T09:00:52.618+0100 [INFO] CLI command args: []string{"plan", "-generate-config-out=generated_resources2.tf"} 2023-11-01T09:00:52.619+0100 [DEBUG] New state was assigned lineage "9195da90-d2ec-736c-ea63-112" 2023-11-01T09:00:52.660+0100 [DEBUG] checking for provisioner in "." 2023-11-01T09:00:52.661+0100 [DEBUG] checking for provisioner in "/home/USER/programs" 2023-11-01T09:00:52.661+0100 [INFO] backend/local: starting Plan operation 2023-11-01T09:00:52.663+0100 [DEBUG] created provider logger: level=debug 2023-11-01T09:00:52.663+0100 [INFO] provider: configuring client automatic mTLS 2023-11-01T09:00:52.672+0100 [DEBUG] provider: starting plugin: path=.terraform/providers/registry.terraform.io/splunk/splunk/1.4.22/linux_amd64/terraform-provider-splunk_v1.4.22 args=[".terraform/providers/registry.terraform.io/splunk/splunk/1.4.22/linux_amd64/terraform-provider-splunk_v1.4.22"] 2023-11-01T09:00:52.673+0100 [DEBUG] provider: plugin started: path=.terraform/providers/registry.terraform.io/splunk/splunk/1.4.22/linux_amd64/terraform-provider-splunk_v1.4.22 pid=61374 2023-11-01T09:00:52.673+0100 [DEBUG] provider: waiting for RPC address: path=.terraform/providers/registry.terraform.io/splunk/splunk/1.4.22/linux_amd64/terraform-provider-splunk_v1.4.22 2023-11-01T09:00:52.679+0100 [INFO] provider.terraform-provider-splunk_v1.4.22: configuring server automatic mTLS: timestamp="2023-11-01T09:00:52.679+0100" 2023-11-01T09:00:52.686+0100 [DEBUG] provider: using plugin: version=5 2023-11-01T09:00:52.686+0100 [DEBUG] provider.terraform-provider-splunk_v1.4.22: plugin address: address=/tmp/plugin2171921060 network=unix timestamp="2023-11-01T09:00:52.686+0100" 2023-11-01T09:00:52.695+0100 [DEBUG] No provider meta schema returned 2023-11-01T09:00:52.697+0100 [DEBUG] provider.stdio: received EOF, stopping recv loop: err="rpc error: code = Unavailable desc = error reading from server: EOF" 2023-11-01T09:00:52.697+0100 [DEBUG] provider: plugin process exited: path=.terraform/providers/registry.terraform.io/splunk/splunk/1.4.22/linux_amd64/terraform-provider-splunk_v1.4.22 pid=61374 2023-11-01T09:00:52.697+0100 [DEBUG] provider: plugin exited 2023-11-01T09:00:52.697+0100 [DEBUG] Building and walking validate graph 2023-11-01T09:00:52.697+0100 [DEBUG] ProviderTransformer: "splunk_saved_searches.saved_search_3" (terraform.NodeValidatableResource) needs provider["registry.terraform.io/splunk/splunk"] 2023-11-01T09:00:52.698+0100 [DEBUG] ReferenceTransformer: "provider[\"registry.terraform.io/splunk/splunk\"]" references: [] 2023-11-01T09:00:52.698+0100 [DEBUG] ReferenceTransformer: "splunk_saved_searches.saved_search_3" references: [] 2023-11-01T09:00:52.699+0100 [DEBUG] Starting graph walk: walkValidate 2023-11-01T09:00:52.699+0100 [DEBUG] created provider logger: level=debug 2023-11-01T09:00:52.699+0100 [INFO] provider: configuring client automatic mTLS 2023-11-01T09:00:52.702+0100 [DEBUG] provider: starting plugin: path=.terraform/providers/registry.terraform.io/splunk/splunk/1.4.22/linux_amd64/terraform-provider-splunk_v1.4.22 args=[".terraform/providers/registry.terraform.io/splunk/splunk/1.4.22/linux_amd64/terraform-provider-splunk_v1.4.22"] 2023-11-01T09:00:52.703+0100 [DEBUG] provider: plugin started: path=.terraform/providers/registry.terraform.io/splunk/splunk/1.4.22/linux_amd64/terraform-provider-splunk_v1.4.22 pid=61387 2023-11-01T09:00:52.703+0100 [DEBUG] provider: waiting for RPC address: path=.terraform/providers/registry.terraform.io/splunk/splunk/1.4.22/linux_amd64/terraform-provider-splunk_v1.4.22 2023-11-01T09:00:52.708+0100 [INFO] provider.terraform-provider-splunk_v1.4.22: configuring server automatic mTLS: timestamp="2023-11-01T09:00:52.708+0100" 2023-11-01T09:00:52.715+0100 [DEBUG] provider.terraform-provider-splunk_v1.4.22: plugin address: network=unix address=/tmp/plugin3458938686 timestamp="2023-11-01T09:00:52.715+0100" 2023-11-01T09:00:52.715+0100 [DEBUG] provider: using plugin: version=5 2023-11-01T09:00:52.724+0100 [DEBUG] No provider meta schema returned 2023-11-01T09:00:52.726+0100 [DEBUG] provider.stdio: received EOF, stopping recv loop: err="rpc error: code = Unavailable desc = error reading from server: EOF" 2023-11-01T09:00:52.727+0100 [DEBUG] provider: plugin process exited: path=.terraform/providers/registry.terraform.io/splunk/splunk/1.4.22/linux_amd64/terraform-provider-splunk_v1.4.22 pid=61387 2023-11-01T09:00:52.727+0100 [DEBUG] provider: plugin exited 2023-11-01T09:00:52.727+0100 [INFO] backend/local: plan calling Plan 2023-11-01T09:00:52.727+0100 [DEBUG] Building and walking plan graph for NormalMode 2023-11-01T09:00:52.727+0100 [DEBUG] ProviderTransformer: "splunk_saved_searches.saved_search_3 (expand)" (terraform.nodeExpandPlannableResource) needs provider["registry.terraform.io/splunk/splunk"] 2023-11-01T09:00:52.727+0100 [DEBUG] ProviderTransformer: "splunk_saved_searches.canary (expand)" (*terraform.nodeExpandPlannableResource) needs provider["registry.terraform.io/splunk/splunk"] 2023-11-01T09:00:52.728+0100 [DEBUG] ReferenceTransformer: "splunk_saved_searches.saved_search_3 (expand)" references: [] 2023-11-01T09:00:52.728+0100 [DEBUG] ReferenceTransformer: "splunk_saved_searches.canary (expand)" references: [] 2023-11-01T09:00:52.728+0100 [DEBUG] ReferenceTransformer: "provider[\"registry.terraform.io/splunk/splunk\"]" references: [] 2023-11-01T09:00:52.728+0100 [DEBUG] Starting graph walk: walkPlan 2023-11-01T09:00:52.728+0100 [DEBUG] created provider logger: level=debug 2023-11-01T09:00:52.728+0100 [INFO] provider: configuring client automatic mTLS 2023-11-01T09:00:52.732+0100 [DEBUG] provider: starting plugin: path=.terraform/providers/registry.terraform.io/splunk/splunk/1.4.22/linux_amd64/terraform-provider-splunk_v1.4.22 args=[".terraform/providers/registry.terraform.io/splunk/splunk/1.4.22/linux_amd64/terraform-provider-splunk_v1.4.22"] 2023-11-01T09:00:52.732+0100 [DEBUG] provider: plugin started: path=.terraform/providers/registry.terraform.io/splunk/splunk/1.4.22/linux_amd64/terraform-provider-splunk_v1.4.22 pid=61399 2023-11-01T09:00:52.732+0100 [DEBUG] provider: waiting for RPC address: path=.terraform/providers/registry.terraform.io/splunk/splunk/1.4.22/linux_amd64/terraform-provider-splunk_v1.4.22 2023-11-01T09:00:52.737+0100 [INFO] provider.terraform-provider-splunk_v1.4.22: configuring server automatic mTLS: timestamp="2023-11-01T09:00:52.737+0100" 2023-11-01T09:00:52.745+0100 [DEBUG] provider: using plugin: version=5 2023-11-01T09:00:52.745+0100 [DEBUG] provider.terraform-provider-splunk_v1.4.22: plugin address: address=/tmp/plugin2571514896 network=unix timestamp="2023-11-01T09:00:52.745+0100" 2023-11-01T09:00:52.755+0100 [DEBUG] No provider meta schema returned 2023-11-01T09:00:52.759+0100 [WARN] ValidateProviderConfig from "provider[\"registry.terraform.io/splunk/splunk\"]" changed the config value, but that value is unused 2023-11-01T09:00:52.855+0100 [DEBUG] ReferenceTransformer: "splunk_saved_searches.saved_search_3" references: [] 2023-11-01T09:00:52.855+0100 [DEBUG] Resource instance state not found for node "splunk_saved_searches.canary", instance splunk_saved_searches.canary 2023-11-01T09:00:52.855+0100 [DEBUG] ReferenceTransformer: "splunk_saved_searches.canary" references: [] splunk_saved_searches.canary: Preparing import... [id=TestCr] splunk_saved_searches.canary: Refreshing state... [id=TestCr] splunk_saved_searches.saved_search_3: Refreshing state... [id=TestCr] 2023-11-01T09:00:52.881+0100 [ERROR] vertex "splunk_saved_searches.canary" error: 404 Not Found: {"messages":[{"type":"ERROR","text":"Could not find object id=TestCr"}]} 2023-11-01T09:00:52.881+0100 [ERROR] vertex "splunk_saved_searches.canary (expand)" error: 404 Not Found: {"messages":[{"type":"ERROR","text":"Could not find object id=TestCr"}]} 2023-11-01T09:00:52.915+0100 [WARN] Provider "registry.terraform.io/splunk/splunk" produced an invalid plan for splunk_saved_searches.saved_search_3, but we are tolerating it because it is using the legacy plugin SDK. The following problems may be the cause of any confusing errors from downstream operations:

.action_create_xsoar_incident_param_server_url: planned value cty.StringVal("") for a non-computed attribute
.action_create_xsoar_incident_param_details: planned value cty.StringVal("") for a non-computed attribute
.action_jira_service_desk_param_jira_priority: planned value cty.StringVal("") for a non-computed attribute
.action_jira_service_desk_param_jira_project: planned value cty.StringVal("") for a non-computed attribute
.action_create_xsoar_incident_param_custom_fields: planned value cty.StringVal("") for a non-computed attribute
.action_jira_service_desk_param_jira_summary: planned value cty.StringVal("") for a non-computed attribute
.action_create_xsoar_incident_param_type: planned value cty.StringVal("") for a non-computed attribute
.is_visible: planned value cty.True for a non-computed attribute
.action_pagerduty_integration_url: planned value cty.StringVal("") for a non-computed attribute
.action_slack_param_fields: planned value cty.StringVal("") for a non-computed attribute
.action_jira_service_desk_param_jira_description: planned value cty.StringVal("") for a non-computed attribute
.action_slack_param_message: planned value cty.StringVal("") for a non-computed attribute
.action_jira_service_desk_param_account: planned value cty.StringVal("") for a non-computed attribute
.action_jira_service_desk_param_jira_issue_type: planned value cty.StringVal("") for a non-computed attribute
.action_create_xsoar_incident_param_severity: planned value cty.StringVal("") for a non-computed attribute
.action_create_xsoar_incident_param_incident_name: planned value cty.StringVal("") for a non-computed attribute
.action_webhook_param_url: planned value cty.StringVal("") for a non-computed attribute
.action_create_xsoar_incident_param_occurred: planned value cty.StringVal("") for a non-computed attribute
.action_slack_param_webhook_url_override: planned value cty.StringVal("") for a non-computed attribute
.action_create_xsoar_incident_param_send_all_servers: planned value cty.StringVal("") for a non-computed attribute
.action_create_xsoar_incident: planned value cty.StringVal("") for a non-computed attribute
.action_slack_param_channel: planned value cty.StringVal("") for a non-computed attribute
.action_slack_param_attachment: planned value cty.StringVal("none") for a non-computed attribute 2023-11-01T09:00:52.919+0100 [INFO] backend/local: plan operation completed

Planning failed. Terraform encountered an error while generating this plan.

╷ │ Error: 404 Not Found: {"messages":[{"type":"ERROR","text":"Could not find object id=TestCr"}]} `

This should import the notification, shouldn't it?

Regards!

splunk / terraform-provider-splunk

Cannot import already existing saved_searches #179