Created a `splunk_data_ui_views` via Terraform, Updating `.xml` source file results in "404 Not Found" upon `terraform apply`

Terraform Providers
1

Hello,

I am working with the splunk_data_ui_views and deployed a dashboard via terraform:

https://registry.terraform.io/providers/splunk/splunk/latest/docs/resources/data_ui_views

Code in main.tf

# main.tf
resource "splunk_data_ui_views" "my_dashboard" {
  name      = "Terraform_Sample_Dashboard"
  eai_data = file("my_dashboard.xml") 

  acl {
    owner = var.splunk_username
    app              = "MY_APP"
    sharing          = "app"
    can_change_perms = true
    can_write        = true
    removable        =true
    write            = ["my-dashboard-role"]
    read             = ["my-dashboard-role"]
  }
}

# provider.tf
terraform {
  backend "s3" {
  
  }
  required_providers {
    splunk = {
      source = "splunk/splunk"
      version = "1.4.22"
    }
  }
}

provider "splunk" {
  url       = "splunk.my_domain:8080"
  username  = var.splunk_username
  password  = var.spunk_password
}

What Worked

We were able to create the dashboard after the first terraform apply, and that went to success and the dashboard shows up in Splunk.

What Isn’t Working, Changing a Simple property in the source XML: Error 404

I simply went to change a small part of the xml in a dropdown, changing:

<choice value="myenvironment">myenvironment</choice>

to:

<choice value="myenvironment">myenvironment-edit</choice>

appending that edit part on just to tinker with the dashboard. The terraform plan was successful and just shows a change to that part of the xml source file:

-        <choice value="myenvironment">myenvironment</choice>
+        <choice value="myenvironment">myenvironment-edit</choice>

But upon terraform apply we get a 404 error:

| Error: 404 Not Found: {"messges":[{"type":"ERROR","text":"Cannot find entity with name=\"Terraform_Sample_Dashboard\""}]}
|
| with splunk_data_ui_views.my_dashboard,
| on main.tf line 2, in resource "splunk_data_ui_views" "my_dashboard":
| 2: resource "splunk_data_ui_views" "my_dashboard" {

But that doesn’t make immediate sense, since:

  1. terraform state list shows my splunk_data_ui_views.my_dashboard just fine
  2. The dashboard we created originally from the first/original terraform apply is also in the UI, so the state file must tracking the real world resource in Splunk.

So, why can’t I simply make an edit of my source xml file if the terraform plan is happy, but I get a 404 upon terraform apply.

I’ve worked with other Terraform providers like Terraform AWS and Terraform New Relic, and a simple property update is pretty seamless.

All this could be me simply being unfamiliar with Splunk and the TF provider for it. Any suggestions are appreciated. Thanks!

Other Files
1 Like
2

I am experiencing the identical problem. Unfortunately, this unanswered post and a likewise unanswered github issue in Splunk’s repo here seem to be the only search results for this problem that I can find.

3

After debugging some, it seems that the URL of the POST request to update the dashboard isn’t working right, and it’s unclear to me whether it’s the terraform provider or the splunk API that’s wrong.

Say your dashboard is called “test_dashboard” and is owned by user “userfoo”. The dashboard update POST request will be sent to

POST /servicesNS/userfoo/search/data/ui/views/test_dashboard?output_mode=json HTTP/1.1

This is correct per https://docs.splunk.com/Documentation/Splunk/8.1.1/RESTREF/RESTknowledge#data.2Fui.2Fviews

However, the Splunk API responds with the 404 you are seeing. If you change the POST url to:

POST /servicesNS/nobody/search/data/ui/views/test_dashboard?output_mode=json HTTP/1.1

the dashboard is updated successfully as expected.