Saved search update handler doesn't support schedule_priority

[muang0]

API requests to update saved searches don't actually update the saved search when the schedule_priority field is set. As a workaround we can remove this field from update requests & instead force new resource creation when this field is updated.

#2

[okaraev]

It happens when you don't have edit_schedule_priority permission. Even though you set it to "", it doesn't mean that provider will not send that key. As a workaround you can delete all keys you have problem with:
unnec := []string{
"auto_summarize.command",
"auto_summarize.cron_schedule",
"auto_summarize.dispatch.time_format",
"auto_summarize.dispatch.ttl",
"auto_summarize.max_disabled_buckets",
"auto_summarize.max_summary_ratio",
"auto_summarize.max_summary_size",
"auto_summarize.suspend_period",
"schedule_priority",
"action.webhook.param.url",
}
for _, item := range unnec {
values.Del(item)
}

But for the solution provider must compare changes, and put only changed values.

[muang0]

Setting the value to an empty string + json:omitempty on that struct field should keep the provider from including that field in the request. Permissions issue being the root cause makes sense, but I'm surprised the error didn't indicate that there was a permissions issue if that is the case. Do you have any thoughts on the associated issue?

[okaraev]

Yes, you're right for that point. My problem was about another field, and when I used your changes it didn't work for me, and because there is no error from terraform apply I couldn't figure out the actual problem. I changed UpdateSavedSearches function to use changes as an argument

func (client *Client) UpdateSavedSearches(name string, owner string, app string, changes map[string]interface{}) error {
	endpoint := client.BuildSplunkURL(nil, "servicesNS", owner, app, "saved", "searches", name)
	resp, err := client.Post(endpoint, changes)
	if err != nil {
		return err
	}
	defer resp.Body.Close()
	return nil
}

And used schema.ResourceData.HasChange function to check if there is a change for each field and generate all the changed fields.
There is no error in the terraform apply output because the provider doesn't check the response from the api server. It should check the response status code and body for error message

terraform-provider-splunk/client/saved_searches.go

Line 42 in f60ef19

resp, err := client.Post(endpoint, values)