Skip to content

fix: handle nil values and URL-encode lookup table file contents#220

Merged
rrossetti-splunk merged 1 commit intosplunk:masterfrom
m3l4n0ff:fix/lookup-table-file-contents
Mar 12, 2026
Merged

fix: handle nil values and URL-encode lookup table file contents#220
rrossetti-splunk merged 1 commit intosplunk:masterfrom
m3l4n0ff:fix/lookup-table-file-contents

Conversation

@m3l4n0ff
Copy link
Contributor

@m3l4n0ff m3l4n0ff commented Mar 10, 2026

Summary

  • Convert nil values in file_contents to empty strings before JSON marshaling to prevent sending null values to the Splunk API, which causes 500 - Unable to save the lookup errors.
  • Use url.Values.Encode() instead of fmt.Sprintf for form body parameters in Create, Read, and Update operations to properly URL-encode special characters (brackets, quotes, etc.) in the JSON contents payload.

Context

When file_contents contains rows with trailing empty fields (e.g. CSV rows where the last column is empty), Terraform's SDK represents these as nil interface values. The previous code passed these directly to json.Marshal, which serialized them as null — causing Splunk's lookup edit API to reject the request with a 500 error.

Additionally, the form body was built using fmt.Sprintf without URL-encoding the contents parameter. Since contents is a JSON string containing characters like [, ], ", and ,, these could break the form parsing on the server side.

Test plan

  • Tested with lookup table files containing empty fields — previously returned 500, now succeeds
  • Tested with lookup table files containing special characters in values — previously returned 500, now succeeds
  • Existing acceptance tests pass

- Convert nil values in file_contents to empty strings before JSON
  marshaling to prevent sending null values to the Splunk API, which
  causes "Unable to save the lookup" errors.
- Use url.Values.Encode() instead of fmt.Sprintf for form body
  parameters in Create, Read, and Update operations to properly
  URL-encode special characters in the JSON contents payload.
@rrossetti-splunk rrossetti-splunk merged commit 7bc74fb into splunk:master Mar 12, 2026
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants