Unable to unset/default splunk_saved_searches actions as expected

[jsworkaccount]

Version: 1.4.4

Summary: There seems to be an issue in tracking codified changes to splunk_saved_searches alert resources, particularly around actions.

Reproduce:

Create (plan and apply) a splunk_saved_search resource, with the following attributes (in addition to required fields, such as name, search, etc):

  actions                   = "email"
  action_email_format       = "table"
  action_email_max_time     = "10m"
  action_email_send_results = false
  action_email_subject      = "pick a name"
  action_email_to           = "[email protected]"
  action_email_track_alert  = true 

Then, comment out the above attributes and plan again. The expected action is for the plan to update the values to be null. This does not occur:

$ terraform plan -refresh=false -parallelism=5 -out=$PLAN_PROD -var-file="./myvars.tfvars"
No changes. Infrastructure is up-to-date.

Impact: This complicates trying to update searches not to produce e-mail alerts. I speculate that it has something to do with the way that actions are implicitly set/tracked.

[anushjay]

Seems similar to issue #35 Maybe this applies here as well - https://github.com/splunk/terraform-provider-splunk/issues/35#issuecomment-763002144