Error when creating a saved search with [ in the name

[zscholl]

When creating a saved search with a [ character in the name, terraform creates the search in Splunk but errors when updating the statefile saying Error: Http Error: [404] 404 Not Found {"messages":[{"type":"ERROR","text":"Could not find object id=%5Bhigh priority%5D my super awesome search"}]}

Ex:

resource "splunk_saved_searches" "compliance_report" {
  name = "[high priority] my super awesome search"
  description = "an awesome search"
  dispatch_earliest_time = "-7d@h"
...

$ terraform apply
splunk_saved_searches.saved_search: Refreshing state... [id=Test alert]

An execution plan has been generated and is shown below.
Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # splunk_saved_searches.compliance_report will be created
  + resource "splunk_saved_searches" "compliance_report" {
...
Plan: 1 to add, 0 to change, 0 to destroy.

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

splunk_saved_searches.compliance_report: Creating...

Error: Http Error: [404] 404 Not Found {"messages":[{"type":"ERROR","text":"Could not find object id=%5Bhigh priority%5D my super awesome search"}]}

  on provider.tf line 126, in resource "splunk_saved_searches" "compliance_report":
 126: resource "splunk_saved_searches" "compliance_report" {

I'm assuming that because the id is url encoding the [ and ] characters that Splunk cannot properly identify the resource which is causing the error. Is there anyway to force the provider to not url encode those characters in the id?

[zscholl]

I had a look at the splunk logs to see what the failed request looked like:

GET /servicesNS/my_splunk_user/search/saved/searches/%255Bhigh+priority%255D+my+super+awesome+search?count=-1&output_mode=json

What seems to be happening is there is an extra % being encoded in the url. If I take away the 25s from the request it works:

http get https://my-splunk-server.com:8089/servicesNS/my_splunk_user/search/saved/searches/%5Bhigh+priority%5D+my+super+awesome+search?count=-1&output_mode=json Authorization:"Bearer $SPLUNK_API_TOKEN"
HTTP/1.1 200 OK

What it seems to me is that internally terraform is url encoding the [ and ] characters because it uses them like so:

splunk_saved_searches.compliance_report: Refreshing state... [id=[high priority] my super awesome search]

So terraform is escaping the [ characters and then the ID gets set as %5Bhigh priority%5D my super awesome search so when URL encoding happens the provider is encoding the % symbol and not [

[anushjay]

@zscholl Thanks for reporting. We will look into the issue and try to implement a solution. Also, feel free to submit a PR if you have already done so, we can work on reviewing and merging it.