Cannot import already existing saved_searches

[HarryBo112]

Hello!
I am using TF 1.6.2 with the Splunk Provider 1.4.22.

I want to import existing notifications / reports / "saved_searches", but it fails with 404.

For testing purposes I've also created a notification via TF named "TestCr", but also this cannot be re-imported:

Created with:

resource "splunk_saved_searches" "saved_search_3" { name = "TestCr" search = "index=jds-globit-logs-long" actions = "email" action_email_format = "table" action_email_max_time = "5m" action_email_max_results = 10 action_email_send_results = false action_email_subject = "Splunk Alert: $name$" action_email_to = "foo@bar.com" action_email_track_alert = true dispatch_earliest_time = "-15m" dispatch_latest_time = "-0m" alert_type = "number of events" alert_comparator = "greater than" alert_threshold = 100 cron_schedule = "*/6 * * * *" is_scheduled = true acl { sharing = "app" app = "foo-app" owner="foo-user } }

I try to import the existing notifications via:

import { to = splunk_saved_searches.my_test_cr id = "TestCr" }

Which then returns 404:

`
2023-11-01T09:00:52.618+0100 [INFO] Terraform version: 1.6.2
2023-11-01T09:00:52.618+0100 [DEBUG] using github.com/hashicorp/go-tfe v1.36.0
2023-11-01T09:00:52.618+0100 [DEBUG] using github.com/hashicorp/hcl/v2 v2.19.1
2023-11-01T09:00:52.618+0100 [DEBUG] using github.com/hashicorp/terraform-svchost v0.1.1
2023-11-01T09:00:52.618+0100 [DEBUG] using github.com/zclconf/go-cty v1.14.1
2023-11-01T09:00:52.618+0100 [INFO] Go runtime version: go1.21.1
2023-11-01T09:00:52.618+0100 [INFO] CLI args: []string{"terraform-1.6.2", "plan", "-generate-config-out=generated_resources2.tf"}
2023-11-01T09:00:52.618+0100 [DEBUG] Attempting to open CLI config file: /home/USER/.terraformrc
2023-11-01T09:00:52.618+0100 [DEBUG] File doesn't exist, but doesn't need to. Ignoring.
2023-11-01T09:00:52.618+0100 [DEBUG] ignoring non-existing provider search directory terraform.d/plugins
2023-11-01T09:00:52.618+0100 [DEBUG] ignoring non-existing provider search directory /home/USER/.terraform.d/plugins
2023-11-01T09:00:52.618+0100 [DEBUG] ignoring non-existing provider search directory /home/USER/.local/share/terraform/plugins
2023-11-01T09:00:52.618+0100 [DEBUG] ignoring non-existing provider search directory /usr/share/plasma/terraform/plugins
2023-11-01T09:00:52.618+0100 [DEBUG] ignoring non-existing provider search directory /usr/local/share/terraform/plugins
2023-11-01T09:00:52.618+0100 [DEBUG] ignoring non-existing provider search directory /usr/share/terraform/plugins
2023-11-01T09:00:52.618+0100 [INFO] CLI command args: []string{"plan", "-generate-config-out=generated_resources2.tf"}
2023-11-01T09:00:52.619+0100 [DEBUG] New state was assigned lineage "9195da90-d2ec-736c-ea63-112"
2023-11-01T09:00:52.660+0100 [DEBUG] checking for provisioner in "."
2023-11-01T09:00:52.661+0100 [DEBUG] checking for provisioner in "/home/USER/programs"
2023-11-01T09:00:52.661+0100 [INFO] backend/local: starting Plan operation
2023-11-01T09:00:52.663+0100 [DEBUG] created provider logger: level=debug
2023-11-01T09:00:52.663+0100 [INFO] provider: configuring client automatic mTLS
2023-11-01T09:00:52.672+0100 [DEBUG] provider: starting plugin: path=.terraform/providers/registry.terraform.io/splunk/splunk/1.4.22/linux_amd64/terraform-provider-splunk_v1.4.22 args=[".terraform/providers/registry.terraform.io/splunk/splunk/1.4.22/linux_amd64/terraform-provider-splunk_v1.4.22"]
2023-11-01T09:00:52.673+0100 [DEBUG] provider: plugin started: path=.terraform/providers/registry.terraform.io/splunk/splunk/1.4.22/linux_amd64/terraform-provider-splunk_v1.4.22 pid=61374
2023-11-01T09:00:52.673+0100 [DEBUG] provider: waiting for RPC address: path=.terraform/providers/registry.terraform.io/splunk/splunk/1.4.22/linux_amd64/terraform-provider-splunk_v1.4.22
2023-11-01T09:00:52.679+0100 [INFO] provider.terraform-provider-splunk_v1.4.22: configuring server automatic mTLS: timestamp="2023-11-01T09:00:52.679+0100"
2023-11-01T09:00:52.686+0100 [DEBUG] provider: using plugin: version=5
2023-11-01T09:00:52.686+0100 [DEBUG] provider.terraform-provider-splunk_v1.4.22: plugin address: address=/tmp/plugin2171921060 network=unix timestamp="2023-11-01T09:00:52.686+0100"
2023-11-01T09:00:52.695+0100 [DEBUG] No provider meta schema returned
2023-11-01T09:00:52.697+0100 [DEBUG] provider.stdio: received EOF, stopping recv loop: err="rpc error: code = Unavailable desc = error reading from server: EOF"
2023-11-01T09:00:52.697+0100 [DEBUG] provider: plugin process exited: path=.terraform/providers/registry.terraform.io/splunk/splunk/1.4.22/linux_amd64/terraform-provider-splunk_v1.4.22 pid=61374
2023-11-01T09:00:52.697+0100 [DEBUG] provider: plugin exited
2023-11-01T09:00:52.697+0100 [DEBUG] Building and walking validate graph
2023-11-01T09:00:52.697+0100 [DEBUG] ProviderTransformer: "splunk_saved_searches.saved_search_3" (*terraform.NodeValidatableResource) needs provider["registry.terraform.io/splunk/splunk"]
2023-11-01T09:00:52.698+0100 [DEBUG] ReferenceTransformer: "provider["registry.terraform.io/splunk/splunk"]" references: []
2023-11-01T09:00:52.698+0100 [DEBUG] ReferenceTransformer: "splunk_saved_searches.saved_search_3" references: []
2023-11-01T09:00:52.699+0100 [DEBUG] Starting graph walk: walkValidate
2023-11-01T09:00:52.699+0100 [DEBUG] created provider logger: level=debug
2023-11-01T09:00:52.699+0100 [INFO] provider: configuring client automatic mTLS
2023-11-01T09:00:52.702+0100 [DEBUG] provider: starting plugin: path=.terraform/providers/registry.terraform.io/splunk/splunk/1.4.22/linux_amd64/terraform-provider-splunk_v1.4.22 args=[".terraform/providers/registry.terraform.io/splunk/splunk/1.4.22/linux_amd64/terraform-provider-splunk_v1.4.22"]
2023-11-01T09:00:52.703+0100 [DEBUG] provider: plugin started: path=.terraform/providers/registry.terraform.io/splunk/splunk/1.4.22/linux_amd64/terraform-provider-splunk_v1.4.22 pid=61387
2023-11-01T09:00:52.703+0100 [DEBUG] provider: waiting for RPC address: path=.terraform/providers/registry.terraform.io/splunk/splunk/1.4.22/linux_amd64/terraform-provider-splunk_v1.4.22
2023-11-01T09:00:52.708+0100 [INFO] provider.terraform-provider-splunk_v1.4.22: configuring server automatic mTLS: timestamp="2023-11-01T09:00:52.708+0100"
2023-11-01T09:00:52.715+0100 [DEBUG] provider.terraform-provider-splunk_v1.4.22: plugin address: network=unix address=/tmp/plugin3458938686 timestamp="2023-11-01T09:00:52.715+0100"
2023-11-01T09:00:52.715+0100 [DEBUG] provider: using plugin: version=5
2023-11-01T09:00:52.724+0100 [DEBUG] No provider meta schema returned
2023-11-01T09:00:52.726+0100 [DEBUG] provider.stdio: received EOF, stopping recv loop: err="rpc error: code = Unavailable desc = error reading from server: EOF"
2023-11-01T09:00:52.727+0100 [DEBUG] provider: plugin process exited: path=.terraform/providers/registry.terraform.io/splunk/splunk/1.4.22/linux_amd64/terraform-provider-splunk_v1.4.22 pid=61387
2023-11-01T09:00:52.727+0100 [DEBUG] provider: plugin exited
2023-11-01T09:00:52.727+0100 [INFO] backend/local: plan calling Plan
2023-11-01T09:00:52.727+0100 [DEBUG] Building and walking plan graph for NormalMode
2023-11-01T09:00:52.727+0100 [DEBUG] ProviderTransformer: "splunk_saved_searches.saved_search_3 (expand)" (*terraform.nodeExpandPlannableResource) needs provider["registry.terraform.io/splunk/splunk"]
2023-11-01T09:00:52.727+0100 [DEBUG] ProviderTransformer: "splunk_saved_searches.canary (expand)" (*terraform.nodeExpandPlannableResource) needs provider["registry.terraform.io/splunk/splunk"]
2023-11-01T09:00:52.728+0100 [DEBUG] ReferenceTransformer: "splunk_saved_searches.saved_search_3 (expand)" references: []
2023-11-01T09:00:52.728+0100 [DEBUG] ReferenceTransformer: "splunk_saved_searches.canary (expand)" references: []
2023-11-01T09:00:52.728+0100 [DEBUG] ReferenceTransformer: "provider["registry.terraform.io/splunk/splunk"]" references: []
2023-11-01T09:00:52.728+0100 [DEBUG] Starting graph walk: walkPlan
2023-11-01T09:00:52.728+0100 [DEBUG] created provider logger: level=debug
2023-11-01T09:00:52.728+0100 [INFO] provider: configuring client automatic mTLS
2023-11-01T09:00:52.732+0100 [DEBUG] provider: starting plugin: path=.terraform/providers/registry.terraform.io/splunk/splunk/1.4.22/linux_amd64/terraform-provider-splunk_v1.4.22 args=[".terraform/providers/registry.terraform.io/splunk/splunk/1.4.22/linux_amd64/terraform-provider-splunk_v1.4.22"]
2023-11-01T09:00:52.732+0100 [DEBUG] provider: plugin started: path=.terraform/providers/registry.terraform.io/splunk/splunk/1.4.22/linux_amd64/terraform-provider-splunk_v1.4.22 pid=61399
2023-11-01T09:00:52.732+0100 [DEBUG] provider: waiting for RPC address: path=.terraform/providers/registry.terraform.io/splunk/splunk/1.4.22/linux_amd64/terraform-provider-splunk_v1.4.22
2023-11-01T09:00:52.737+0100 [INFO] provider.terraform-provider-splunk_v1.4.22: configuring server automatic mTLS: timestamp="2023-11-01T09:00:52.737+0100"
2023-11-01T09:00:52.745+0100 [DEBUG] provider: using plugin: version=5
2023-11-01T09:00:52.745+0100 [DEBUG] provider.terraform-provider-splunk_v1.4.22: plugin address: address=/tmp/plugin2571514896 network=unix timestamp="2023-11-01T09:00:52.745+0100"
2023-11-01T09:00:52.755+0100 [DEBUG] No provider meta schema returned
2023-11-01T09:00:52.759+0100 [WARN] ValidateProviderConfig from "provider["registry.terraform.io/splunk/splunk"]" changed the config value, but that value is unused
2023-11-01T09:00:52.855+0100 [DEBUG] ReferenceTransformer: "splunk_saved_searches.saved_search_3" references: []
2023-11-01T09:00:52.855+0100 [DEBUG] Resource instance state not found for node "splunk_saved_searches.canary", instance splunk_saved_searches.canary
2023-11-01T09:00:52.855+0100 [DEBUG] ReferenceTransformer: "splunk_saved_searches.canary" references: []
splunk_saved_searches.canary: Preparing import... [id=TestCr]
splunk_saved_searches.canary: Refreshing state... [id=TestCr]
splunk_saved_searches.saved_search_3: Refreshing state... [id=TestCr]
2023-11-01T09:00:52.881+0100 [ERROR] vertex "splunk_saved_searches.canary" error: 404 Not Found: {"messages":[{"type":"ERROR","text":"Could not find object id=TestCr"}]}
2023-11-01T09:00:52.881+0100 [ERROR] vertex "splunk_saved_searches.canary (expand)" error: 404 Not Found: {"messages":[{"type":"ERROR","text":"Could not find object id=TestCr"}]}
2023-11-01T09:00:52.915+0100 [WARN] Provider "registry.terraform.io/splunk/splunk" produced an invalid plan for splunk_saved_searches.saved_search_3, but we are tolerating it because it is using the legacy plugin SDK.
The following problems may be the cause of any confusing errors from downstream operations:
- .action_create_xsoar_incident_param_server_url: planned value cty.StringVal("") for a non-computed attribute
- .action_create_xsoar_incident_param_details: planned value cty.StringVal("") for a non-computed attribute
- .action_jira_service_desk_param_jira_priority: planned value cty.StringVal("") for a non-computed attribute
- .action_jira_service_desk_param_jira_project: planned value cty.StringVal("") for a non-computed attribute
- .action_create_xsoar_incident_param_custom_fields: planned value cty.StringVal("") for a non-computed attribute
- .action_jira_service_desk_param_jira_summary: planned value cty.StringVal("") for a non-computed attribute
- .action_create_xsoar_incident_param_type: planned value cty.StringVal("") for a non-computed attribute
- .is_visible: planned value cty.True for a non-computed attribute
- .action_pagerduty_integration_url: planned value cty.StringVal("") for a non-computed attribute
- .action_slack_param_fields: planned value cty.StringVal("") for a non-computed attribute
- .action_jira_service_desk_param_jira_description: planned value cty.StringVal("") for a non-computed attribute
- .action_slack_param_message: planned value cty.StringVal("") for a non-computed attribute
- .action_jira_service_desk_param_account: planned value cty.StringVal("") for a non-computed attribute
- .action_jira_service_desk_param_jira_issue_type: planned value cty.StringVal("") for a non-computed attribute
- .action_create_xsoar_incident_param_severity: planned value cty.StringVal("") for a non-computed attribute
- .action_create_xsoar_incident_param_incident_name: planned value cty.StringVal("") for a non-computed attribute
- .action_webhook_param_url: planned value cty.StringVal("") for a non-computed attribute
- .action_create_xsoar_incident_param_occurred: planned value cty.StringVal("") for a non-computed attribute
- .action_slack_param_webhook_url_override: planned value cty.StringVal("") for a non-computed attribute
- .action_create_xsoar_incident_param_send_all_servers: planned value cty.StringVal("") for a non-computed attribute
- .action_create_xsoar_incident: planned value cty.StringVal("") for a non-computed attribute
- .action_slack_param_channel: planned value cty.StringVal("") for a non-computed attribute
- .action_slack_param_attachment: planned value cty.StringVal("none") for a non-computed attribute
2023-11-01T09:00:52.919+0100 [INFO] backend/local: plan operation completed

Planning failed. Terraform encountered an error while generating this plan.

╷
│ Error: 404 Not Found: {"messages":[{"type":"ERROR","text":"Could not find object id=TestCr"}]}
`

This should import the notification, shouldn't it?

Regards!

[DaraDadachanji]

I am also having this issue

[RamanVaskevich1984]

Is this something permissions related to access Splunk Rest API?
I am also having this issue with Import:

terraform import 'module.splunk_alerts.splunk_saved_searches.alert["[TEAM] BRIX_NNMi_Windstream_Debit_Access_Ping_Test"]' /servicesNS/nobody/search/saved/searches/[TEAM]%20BRIX_NNMi_Windstream_Debit_Access_Ping_Test
module.splunk_alerts.splunk_saved_searches.alert["[TEAM] BRIX_NNMi_Windstream_Debit_Access_Ping_Test"]: Importing from ID "/servicesNS/nobody/search/saved/searches/[TEAM]%20BRIX_NNMi_Windstream_Debit_Access_Ping_Test"...
module.splunk_alerts.splunk_saved_searches.alert["[TEAM] BRIX_NNMi_Windstream_Debit_Access_Ping_Test"]: Import prepared!
Prepared splunk_saved_searches for import
module.splunk_alerts.splunk_saved_searches.alert["[TEAM] BRIX_NNMi_Windstream_Debit_Access_Ping_Test"]: Refreshing state... [id=/servicesNS/nobody/search/saved/searches/[TEAM]%20BRIX_NNMi_Windstream_Debit_Access_Ping_Test]
╷
│ Error: 404 Not Found: {"messages":[{"type":"ERROR","text":"Invalid custom action for this internal handler (handler: savedsearch, custom action: nobody, eai action: list)."}]}
│