[benelser]

Removing dispatch_index_earliest or dispatch_index_latest from a splunk_saved_searches resource, or setting either to null or "", leaves the old value in Splunk, and terraform plan reports no changes. Once an index-time window is set, Terraform can't clear it.

Refs #35, #72

Reproduce (v1.6.1)

1. Apply a saved search with dispatch_index_earliest = "-10m" and dispatch_index_latest = "-5m".
2. Delete both lines, or set them to null or "".
3. terraform plan reports no changes, and Splunk still has dispatch.index_earliest = -10m.

Cause

• Splunk keeps any key an update leaves out, so clearing one means posting key=.
• Both attributes are Optional and Computed. The SDK keeps the prior value when the attribute is missing and treats "" as unset, so the plan never shows a change.
• The client couldn't send the clear anyway: EncodeObject drops every empty value, and both fields are tagged omitempty.

Change

• Remove Computed from both attributes. Splunk's default for both is empty, so configurations that never set them plan no change.
• UpdateSavedSearches takes the keys to clear and appends each as key= after the normal encoding. The resource passes a key only when its attribute changed to empty, so no other empty value is posted.
• Fix the two attributes' descriptions, which were swapped.

Behavior change

A saved search whose index window was set outside Terraform, and not in the configuration, now plans a change that clears it.

Suggested changelog entry:

• Fix: splunk_saved_searches clears dispatch_index_earliest and dispatch_index_latest when they are removed from the configuration or set to "". A value set outside Terraform and missing from the configuration is cleared on the next apply

Testing

• TestSavedSearchesUpdateClearsDispatchIndexWindow plans and applies against a server that keeps omitted keys. It checks that removing the attributes or setting them to "" clears them, the next plan is clean, no other empty value is posted, a later unrelated change doesn't resend the clear, and setting the window again posts only the new value.
• TestAccSplunkSavedSearchesDispatchIndexCleared runs set, remove, set, empty against Splunk.
• The unit test fails on v1.6.1 and passes with this change. Reverting each part of the change on its own (restoring Computed, not passing the keys, clearing on every update, clearing on any change) fails it.
• go test ./... and golangci-lint v1.61 pass. The repository's test workflow passes against Splunk 10.6.1 (splunk/splunk:latest), including the new acceptance test.

[benelser]

@rrossetti-splunk, could you review this when you have a chance? It lets dispatch_index_earliest and dispatch_index_latest be cleared (#35, #72).