State not accurate w/r/t splunk_saved_searches->alert_track

[jsworkaccount]

Steps to reproduce: TF version: 0.13.5 Provider version: 1.3.0 (also appears to be an issue in current) Splunk version: 7.2.6

1. Invoke a splunk_saved_searches resource, setting alert_track to true; e.g.,

   
   resource "splunk_saved_searches" "mysearch" {
   name                      = "test"
   
   [...redacted parameters...]
   
   alert_comparator          = "greater than" 
   alert_digest_mode         = false 
   alert_threshold           = "0" 
   alert_severity            = "3" 
   alert_track               = true 
   alert_type                = "number of events" 
   is_scheduled              = true 
   acl {
   app     = "our_app"
   owner   = "our_owner"
   sharing = "app"
   }
   }

2. apply the configuration.
3. run a `terraform plan` using the same configuration.  If the problem persists, Terraform will think that the resource's `alert_track` value has changed.  The tfstate file seems to believe that the actual value of alert_track is `""`, which is different from `true`.  Excerpt from plan output follows:

splunk_saved_searches.mysearch will be updated in-place

[...redacted...]

• alert_track = "true"

This is problematic, because, if one terraform state is being used to manage a large number of searches, a terraform apply will attempt to update every resource that has an explicit alert_type definition - and will also fail if any one of those updates fails for any reason (such as a timeout). It also increases the runtime of a terraform apply (particularly when only one resource is being changed, within a large state). Attempting to invoke the same without alert_type defined does not seem to yield alert_type = true as a default in the above-documented environment.

[anushjay]

@jsworkaccount Yeah, that was a bug. Fixed it and it should be available in the next release.

[anushjay]

Fix in v1.4.1