fix 0 values for save search params (#221)

* add test for 0 values of action_email parameters
* also fix tests so optional run lookup file tests

Author: rrossetti-splunk

CHANGELOG.md

@@ -1,3 +1,7 @@
+## 1.4.36
+* Fix: saved search action_email_include_results_link handles 0 value 
+* Fix: saved search action_email_include_view_link handles 0 value
+
 ## 1.4.35
 * Fix: lookup_table_file - handle nil values in file_contents by converting to empty strings before JSON marshaling
 * Fix: lookup_table_file - properly URL-encode form parameters in Create/Read/Update operations

Makefile

@@ -21,11 +21,13 @@ fmt:
 build:
 	go build -o terraform-provider-splunk .
 
+# Use external linker on macOS to avoid dyld "missing LC_UUID" abort (macOS 15+).
+# TF_ACC= ensures acceptance tests are skipped (no API required).
 test:
-	go test ./...
+	TF_ACC= go test -ldflags="-linkmode=external" ./...
 
 testacc:
-	TF_ACC=1 go test ./... -v
+	TF_ACC=1 go test -ldflags="-linkmode=external" ./... -v
 
 init:
 	@terraform init

client/models/saved_searches.go

@@ -22,11 +22,11 @@ type SavedSearchObject struct {
 	ActionEmailFormat                            string  `json:"action.email.format,omitempty" url:"action.email.format,omitempty"`
 	ActionEmailFrom                              string  `json:"action.email.from,omitempty" url:"action.email.from,omitempty"`
 	ActionEmailHostname                          string  `json:"action.email.hostname,omitempty" url:"action.email.hostname,omitempty"`
-	ActionEmailIncludeResultsLink                int     `json:"action.email.include.results_link,string,omitempty" url:"action.email.include.results_link,omitempty"`
+	ActionEmailIncludeResultsLink                int     `json:"action.email.include.results_link,string,omitempty" url:"action.email.include.results_link"`
 	ActionEmailIncludeSearch                     int     `json:"action.email.include.search,string,omitempty" url:"action.email.include.search,omitempty"`
 	ActionEmailIncludeTrigger                    int     `json:"action.email.include.trigger,string,omitempty" url:"action.email.include.trigger,omitempty"`
 	ActionEmailIncludeTriggerTime                int     `json:"action.email.include.trigger_time,string,omitempty" url:"action.email.include.trigger_time,omitempty"`
-	ActionEmailIncludeViewLink                   int     `json:"action.email.include.view_link,string,omitempty" url:"action.email.include.view_link,omitempty"`
+	ActionEmailIncludeViewLink                   int     `json:"action.email.include.view_link,string,omitempty" url:"action.email.include.view_link"`
 	ActionEmailInline                            bool    `json:"action.email.inline" url:"action.email.inline"`
 	ActionEmailMailserver                        string  `json:"action.email.mailserver,omitempty" url:"action.email.mailserver,omitempty"`
 	ActionEmailMaxResults                        int     `json:"action.email.maxresults,omitempty" url:"action.email.maxresults,omitempty"`

docs/resources/lookup_table_file.md

@@ -1,6 +1,9 @@
 # Resource: splunk_lookup_table_file
 Create and manage lookup table files.
 
+## Requirements
+This resource uses the Splunk `data/lookup_edit` REST API to create and update lookup file contents. That API is not part of core Splunk Enterprise; it is typically provided by the **Splunk App for Lookup File Editing** (Lookup Editor app). If the API is not available, the provider will receive 404 errors. Install the app on your Splunk instance if you need to manage lookup table file contents with Terraform.
+
 ## Example Usage
 ```
 resource "splunk_lookup_table_file" "lookup_table_file" {

splunk/resource_splunk_lookup_table_file_test.go

@@ -3,6 +3,7 @@ package splunk
 import (
 	"fmt"
 	"net/http"
+	"os"
 	"testing"
 
 	"github.com/hashicorp/terraform-plugin-sdk/helper/resource"
@@ -37,6 +38,13 @@ resource "splunk_lookup_table_file" "test" {
 `
 
 func TestAccSplunkLookupTableFile(t *testing.T) {
+	// The splunk_lookup_table_file resource uses the lookup_edit API (e.g. from the
+	// Splunk App for Lookup File Editing), which is not part of core Splunk. If that
+	// API is not available, the provider gets 404. Skip this test unless the env var
+	// is set so CI and default runs do not fail.
+	if os.Getenv("SPLUNK_TEST_LOOKUP_TABLE_FILE") == "" {
+		t.Skip("Skipping lookup table file test; set SPLUNK_TEST_LOOKUP_TABLE_FILE=1 when Splunk has the Lookup File Editing API available (e.g. Splunk App for Lookup File Editing installed)")
+	}
 	resourceName := "splunk_lookup_table_file.test"
 	resource.Test(t, resource.TestCase{
 		PreCheck: func() {

splunk/resource_splunk_saved_searches_test.go

@@ -97,6 +97,40 @@ resource "splunk_saved_searches" "test" {
     }
 }
 `
+
+// savedSearchesEmailIncludeLinksZero sets action_email_include_results_link and
+// action_email_include_view_link to 0 to verify they are sent to the API and
+// returned on read (and thus appear in savedsearches.conf).
+const savedSearchesEmailIncludeLinksZero = `
+resource "splunk_saved_searches" "test" {
+    name = "Test Email Include Links Zero"
+    search = "index=main"
+    actions = "email"
+    action_email_include_results_link = 0
+    action_email_include_view_link = 0
+    action_email_include_search = 0
+    action_email_include_trigger = 1
+    action_email_format = "table"
+    action_email_max_time = "5m"
+    action_email_max_results = 10
+    action_email_send_csv = 1
+    action_email_send_results = false
+    action_email_subject = "Splunk Alert: $name$"
+    action_email_to = "splunk@splunk.com"
+    action_email_track_alert = true
+    alert_track = true
+    dispatch_earliest_time = "rt-15m"
+    dispatch_latest_time = "rt-0m"
+    dispatch_index_earliest = "-10m"
+    dispatch_index_latest = "-5m"
+    cron_schedule = "*/5 * * * *"
+    acl {
+      owner = "admin"
+      sharing = "app"
+      app = "launcher"
+    }
+}
+`
 const newSavedSearchesLogEvent = `
 resource "splunk_saved_searches" "test" {
 	name = "Test Log Event Alert"
@@ -742,6 +776,30 @@ func TestAccSplunkSavedSearches(t *testing.T) {
 	})
 }
 
+// TestAccSplunkSavedSearchesEmailIncludeLinksZero verifies that setting
+// action_email_include_results_link and action_email_include_view_link to 0
+// sends them to the API and they are returned on read (and appear in savedsearches.conf).
+func TestAccSplunkSavedSearchesEmailIncludeLinksZero(t *testing.T) {
+	resourceName := "splunk_saved_searches.test"
+	resource.Test(t, resource.TestCase{
+		PreCheck: func() {
+			testAccPreCheck(t)
+		},
+		Providers:    testAccProviders,
+		CheckDestroy: testAccSplunkSavedSearchesDestroyResources,
+		Steps: []resource.TestStep{
+			{
+				Config: savedSearchesEmailIncludeLinksZero,
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(resourceName, "name", "Test Email Include Links Zero"),
+					resource.TestCheckResourceAttr(resourceName, "action_email_include_results_link", "0"),
+					resource.TestCheckResourceAttr(resourceName, "action_email_include_view_link", "0"),
+				),
+			},
+		},
+	})
+}
+
 func testAccSplunkSavedSearchesDestroyResources(s *terraform.State) error {
 	client, err := newTestClient()
 	if err != nil {