Can't create alert's using splunk_saved_searches it keep create it as report

[tameraz-tr]

I am trying to create an alert using "splunk_saved_searches" and it always creates it as a report instead of an alert.
For example, I have tried this configuration:
resource "splunk_saved_searches" "saved_search" {
actions = "email"
action_email_format = "table"
action_email_max_time = "5m"
action_email_send_results = true
action_email_subject = "Splunk Alert: $name$"
action_email_message_alert = "$name$"
action_email_to = "[email protected]"
action_email_track_alert = true
description = "New search for user01"
dispatch_earliest_time = "rt-15m"
dispatch_latest_time = "rt-0m"
name = "new-search-01"
search = "index=main"
alert_track = false
alert_comparator = "greater than"
alert_threshold = 0
acl {
app = "search"
owner = "admin"
sharing = "app"
}
realtime_schedule = false
cron_schedule = "* * * * *"
alert_suppress = "true"
}

[doronkg]

In order to set the saved search as an alert, you'll need to specify is_scheduled = "true".

Note that when setting the saved search as an alert with the paramater mentioned above and using alert_suppress = "true", you'll also have to specify alert_suppress_period and not leave it empty, otherwise the alert validation would fail and the saved search won't be created.

[jeffsanicola]

I'm running into this as well.

Can anyone provide a minimal example that will produce an email alert instead of a report?

Here's an example of something I'm attempting but it's still being created as a report.

resource "splunk_saved_searches" "example" {
  name        = "alert_name"
  search      = "index=main"
  description = "My description"

  actions = "email"

  action_email_inline        = true
  action_email_message_alert = "Something broke!"
  action_email_send_results  = true
  action_email_subject       = "Splunk Alert: $name$"
  action_email_to            = "[email protected]"
  action_email_track_alert   = true

  cron_schedule = "*/5 * * * *"
  is_scheduled  = true

  dispatch_earliest_time = "-5m@m"
  dispatch_latest_time   = "now"
  dispatch_max_count     = 1

  acl {
    app     = "launcher"
    owner   = "my_user"
    sharing = "app"
  }
}

TIA!

[okaraev]

@jeffsanicola try alert_track = true

[jeffsanicola]

@okaraev - that looks to have done the trick. Thank you!