Merging upstream version 9.4.0+dfsg.

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

16 files changed, 348 insertions, 343 deletions

diff --git a/ansible_collections/splunk/es/tests/unit/compat/builtins.py b/ansible_collections/splunk/es/tests/unit/compat/builtins.py
deleted file mode 100644
index bfc8adfbe..000000000
--- a/ansible_collections/splunk/es/tests/unit/compat/builtins.py
+++ /dev/null
@@ -1,34 +0,0 @@
-# (c) 2014, Toshio Kuratomi <tkuratomi@ansible.com>
-#
-# This file is part of Ansible
-#
-# Ansible is free software: you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation, either version 3 of the License, or
-# (at your option) any later version.
-#
-# Ansible is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Ansible.  If not, see <http://www.gnu.org/licenses/>.
-
-# Make coding more python3-ish
-from __future__ import absolute_import, division, print_function
-
-__metaclass__ = type
-
-#
-# Compat for python2.7
-#
-
-# One unittest needs to import builtins via __import__() so we need to have
-# the string that represents it
-try:
-    import __builtin__
-except ImportError:
-    BUILTINS = "builtins"
-else:
-    BUILTINS = "__builtin__"
diff --git a/ansible_collections/splunk/es/tests/unit/compat/mock.py b/ansible_collections/splunk/es/tests/unit/compat/mock.py
index 2ea98a17f..61ac88700 100644
--- a/ansible_collections/splunk/es/tests/unit/compat/mock.py
+++ b/ansible_collections/splunk/es/tests/unit/compat/mock.py
@@ -19,6 +19,7 @@
 # Make coding more python3-ish
 from __future__ import absolute_import, division, print_function
 
+
 __metaclass__ = type
 
 """
@@ -26,6 +27,7 @@ Compat module for Python3.x's unittest.mock module
 """
 import sys
 
+
 # Python 2.7
 
 # Note: Could use the pypi mock library on python3.x as well as python2.x.  It
@@ -104,7 +106,7 @@ if sys.version_info >= (3,) and sys.version_info < (3, 4, 4):
             import _io
 
             file_spec = list(
-                set(dir(_io.TextIOWrapper)).union(set(dir(_io.BytesIO)))
+                set(dir(_io.TextIOWrapper)).union(set(dir(_io.BytesIO))),
             )
 
         if mock is None:
diff --git a/ansible_collections/splunk/es/tests/unit/compat/unittest.py b/ansible_collections/splunk/es/tests/unit/compat/unittest.py
index df3379b82..df4266ec9 100644
--- a/ansible_collections/splunk/es/tests/unit/compat/unittest.py
+++ b/ansible_collections/splunk/es/tests/unit/compat/unittest.py
@@ -18,6 +18,7 @@
 # Make coding more python3-ish
 from __future__ import absolute_import, division, print_function
 
+
 __metaclass__ = type
 
 """
@@ -26,6 +27,7 @@ Compat module for Python2.7's unittest module
 
 import sys
 
+
 # Allow wildcard import because we really do want to import all of
 # unittests's symbols into this compat shim
 # pylint: disable=wildcard-import,unused-wildcard-import
diff --git a/ansible_collections/splunk/es/tests/unit/mock/loader.py b/ansible_collections/splunk/es/tests/unit/mock/loader.py
index 19c44a7e8..011c67b29 100644
--- a/ansible_collections/splunk/es/tests/unit/mock/loader.py
+++ b/ansible_collections/splunk/es/tests/unit/mock/loader.py
@@ -18,19 +18,20 @@
 # Make coding more python3-ish
 from __future__ import absolute_import, division, print_function
 
+
 __metaclass__ = type
 
 import os
 
 from ansible.errors import AnsibleParserError
-from ansible.parsing.dataloader import DataLoader
 from ansible.module_utils._text import to_bytes, to_text
+from ansible.parsing.dataloader import DataLoader
 
 
 class DictDataLoader(DataLoader):
     def __init__(self, file_mapping=None):
         file_mapping = {} if file_mapping is None else file_mapping
-        assert type(file_mapping) == dict
+        assert isinstance(file_mapping, dict)
 
         super(DictDataLoader, self).__init__()
 
diff --git a/ansible_collections/splunk/es/tests/unit/mock/path.py b/ansible_collections/splunk/es/tests/unit/mock/path.py
index 1e5902864..06f1a3d56 100644
--- a/ansible_collections/splunk/es/tests/unit/mock/path.py
+++ b/ansible_collections/splunk/es/tests/unit/mock/path.py
@@ -1,12 +1,13 @@
 from __future__ import absolute_import, division, print_function
 
+
 __metaclass__ = type
-from ansible_collections.trendmicro.deepsec.tests.unit.compat.mock import (
-    MagicMock,
-)
 from ansible.utils.path import unfrackpath
 
+from ansible_collections.splunk.es.tests.unit.compat.mock import MagicMock
+
 
 mock_unfrackpath_noop = MagicMock(
-    spec_set=unfrackpath, side_effect=lambda x, *args, **kwargs: x
+    spec_set=unfrackpath,
+    side_effect=lambda x, *args, **kwargs: x,
 )
diff --git a/ansible_collections/splunk/es/tests/unit/mock/procenv.py b/ansible_collections/splunk/es/tests/unit/mock/procenv.py
index f7ab5fe91..3699c6308 100644
--- a/ansible_collections/splunk/es/tests/unit/mock/procenv.py
+++ b/ansible_collections/splunk/es/tests/unit/mock/procenv.py
@@ -19,16 +19,19 @@
 # Make coding more python3-ish
 from __future__ import absolute_import, division, print_function
 
+
 __metaclass__ = type
 
-import sys
 import json
+import sys
 
 from contextlib import contextmanager
 from io import BytesIO, StringIO
-from ansible_collections.trendmicro.deepsec.tests.unit.compat import unittest
-from ansible.module_utils.six import PY3
+
 from ansible.module_utils._text import to_bytes
+from ansible.module_utils.six import PY3
+
+from ansible_collections.splunk.es.tests.unit.compat import unittest
 
 
 @contextmanager
diff --git a/ansible_collections/splunk/es/tests/unit/mock/vault_helper.py b/ansible_collections/splunk/es/tests/unit/mock/vault_helper.py
index b34ae1340..82d01f5c5 100644
--- a/ansible_collections/splunk/es/tests/unit/mock/vault_helper.py
+++ b/ansible_collections/splunk/es/tests/unit/mock/vault_helper.py
@@ -14,10 +14,10 @@
 # Make coding more python3-ish
 from __future__ import absolute_import, division, print_function
 
+
 __metaclass__ = type
 
 from ansible.module_utils._text import to_bytes
-
 from ansible.parsing.vault import VaultSecret
 
 
@@ -38,5 +38,7 @@ class TextVaultSecret(VaultSecret):
     def bytes(self):
         """The text encoded with encoding, unless we specifically set _bytes."""
         return self._bytes or to_bytes(
-            self.text, encoding=self.encoding, errors=self.errors
+            self.text,
+            encoding=self.encoding,
+            errors=self.errors,
         )
diff --git a/ansible_collections/splunk/es/tests/unit/mock/yaml_helper.py b/ansible_collections/splunk/es/tests/unit/mock/yaml_helper.py
index 5df30aaed..e46d3180b 100644
--- a/ansible_collections/splunk/es/tests/unit/mock/yaml_helper.py
+++ b/ansible_collections/splunk/es/tests/unit/mock/yaml_helper.py
@@ -1,12 +1,14 @@
 from __future__ import absolute_import, division, print_function
 
+
 __metaclass__ = type
 import io
+
 import yaml
 
 from ansible.module_utils.six import PY3
-from ansible.parsing.yaml.loader import AnsibleLoader
 from ansible.parsing.yaml.dumper import AnsibleDumper
+from ansible.parsing.yaml.loader import AnsibleLoader
 
 
 class YamlTestUtils(object):
@@ -45,7 +47,8 @@ class YamlTestUtils(object):
 
         # dump the gen 2 objects directory to strings
         string_from_object_dump_2 = self._dump_string(
-            obj_2, dumper=AnsibleDumper
+            obj_2,
+            dumper=AnsibleDumper,
         )
 
         # The gen 1 and gen 2 yaml strings
@@ -59,7 +62,8 @@ class YamlTestUtils(object):
         obj_3 = loader_3.get_data()
 
         string_from_object_dump_3 = self._dump_string(
-            obj_3, dumper=AnsibleDumper
+            obj_3,
+            dumper=AnsibleDumper,
         )
 
         self.assertEqual(obj, obj_3)
@@ -93,10 +97,14 @@ class YamlTestUtils(object):
 
         if PY3:
             yaml.dump(
-                obj_from_stream, stream_obj_from_stream, Dumper=AnsibleDumper
+                obj_from_stream,
+                stream_obj_from_stream,
+                Dumper=AnsibleDumper,
             )
             yaml.dump(
-                obj_from_stream, stream_obj_from_string, Dumper=AnsibleDumper
+                obj_from_stream,
+                stream_obj_from_string,
+                Dumper=AnsibleDumper,
             )
         else:
             yaml.dump(
@@ -120,25 +128,27 @@ class YamlTestUtils(object):
 
         if PY3:
             yaml_string_obj_from_stream = yaml.dump(
-                obj_from_stream, Dumper=AnsibleDumper
+                obj_from_stream,
+                Dumper=AnsibleDumper,
             )
             yaml_string_obj_from_string = yaml.dump(
-                obj_from_string, Dumper=AnsibleDumper
+                obj_from_string,
+                Dumper=AnsibleDumper,
             )
         else:
             yaml_string_obj_from_stream = yaml.dump(
-                obj_from_stream, Dumper=AnsibleDumper, encoding=None
+                obj_from_stream,
+                Dumper=AnsibleDumper,
+                encoding=None,
             )
             yaml_string_obj_from_string = yaml.dump(
-                obj_from_string, Dumper=AnsibleDumper, encoding=None
+                obj_from_string,
+                Dumper=AnsibleDumper,
+                encoding=None,
             )
 
         assert yaml_string == yaml_string_obj_from_stream
-        assert (
-            yaml_string
-            == yaml_string_obj_from_stream
-            == yaml_string_obj_from_string
-        )
+        assert yaml_string == yaml_string_obj_from_stream == yaml_string_obj_from_string
         assert (
             yaml_string
             == yaml_string_obj_from_stream
diff --git a/ansible_collections/splunk/es/tests/unit/modules/conftest.py b/ansible_collections/splunk/es/tests/unit/modules/conftest.py
index e19a1e04c..349e71ada 100644
--- a/ansible_collections/splunk/es/tests/unit/modules/conftest.py
+++ b/ansible_collections/splunk/es/tests/unit/modules/conftest.py
@@ -2,15 +2,16 @@
 # GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
 from __future__ import absolute_import, division, print_function
 
+
 __metaclass__ = type
 
 import json
 
 import pytest
 
-from ansible.module_utils.six import string_types
 from ansible.module_utils._text import to_bytes
 from ansible.module_utils.common._collections_compat import MutableMapping
+from ansible.module_utils.six import string_types
 
 
 @pytest.fixture
@@ -21,20 +22,13 @@ def patch_ansible_module(request, mocker):
         if "ANSIBLE_MODULE_ARGS" not in request.param:
             request.param = {"ANSIBLE_MODULE_ARGS": request.param}
         if "_ansible_remote_tmp" not in request.param["ANSIBLE_MODULE_ARGS"]:
-            request.param["ANSIBLE_MODULE_ARGS"][
-                "_ansible_remote_tmp"
-            ] = "/tmp"
-        if (
-            "_ansible_keep_remote_files"
-            not in request.param["ANSIBLE_MODULE_ARGS"]
-        ):
-            request.param["ANSIBLE_MODULE_ARGS"][
-                "_ansible_keep_remote_files"
-            ] = False
+            request.param["ANSIBLE_MODULE_ARGS"]["_ansible_remote_tmp"] = "/tmp"
+        if "_ansible_keep_remote_files" not in request.param["ANSIBLE_MODULE_ARGS"]:
+            request.param["ANSIBLE_MODULE_ARGS"]["_ansible_keep_remote_files"] = False
         args = json.dumps(request.param)
     else:
         raise Exception(
-            "Malformed data to the patch_ansible_module pytest fixture"
+            "Malformed data to the patch_ansible_module pytest fixture",
         )
 
     mocker.patch("ansible.module_utils.basic._ANSIBLE_ARGS", to_bytes(args))
diff --git a/ansible_collections/splunk/es/tests/unit/modules/utils.py b/ansible_collections/splunk/es/tests/unit/modules/utils.py
index d55afc0b3..923594463 100644
--- a/ansible_collections/splunk/es/tests/unit/modules/utils.py
+++ b/ansible_collections/splunk/es/tests/unit/modules/utils.py
@@ -1,13 +1,15 @@
 from __future__ import absolute_import, division, print_function
 
+
 __metaclass__ = type
 import json
 
-from ansible_collections.trendmicro.deepsec.tests.unit.compat import unittest
-from ansible_collections.trendmicro.deepsec.tests.unit.compat.mock import patch
 from ansible.module_utils import basic
 from ansible.module_utils._text import to_bytes
 
+from ansible_collections.splunk.es.tests.unit.compat import unittest
+from ansible_collections.splunk.es.tests.unit.compat.mock import patch
+
 
 def set_module_args(args):
     if "_ansible_remote_tmp" not in args:
@@ -41,7 +43,9 @@ def fail_json(*args, **kwargs):
 class ModuleTestCase(unittest.TestCase):
     def setUp(self):
         self.mock_module = patch.multiple(
-            basic.AnsibleModule, exit_json=exit_json, fail_json=fail_json
+            basic.AnsibleModule,
+            exit_json=exit_json,
+            fail_json=fail_json,
         )
         self.mock_module.start()
         self.mock_sleep = patch("time.sleep")
diff --git a/ansible_collections/splunk/es/tests/unit/plugins/action/test_es_adaptive_response_notable_events.py b/ansible_collections/splunk/es/tests/unit/plugins/action/test_es_adaptive_response_notable_events.py
index b6a84fc78..96993c6dc 100644
--- a/ansible_collections/splunk/es/tests/unit/plugins/action/test_es_adaptive_response_notable_events.py
+++ b/ansible_collections/splunk/es/tests/unit/plugins/action/test_es_adaptive_response_notable_events.py
@@ -18,27 +18,27 @@
 
 from __future__ import absolute_import, division, print_function
 
+
 __metaclass__ = type
 
 from ansible.module_utils.six import PY2
 
+
 builtin_import = "builtins.__import__"
 if PY2:
     builtin_import = "__builtin__.__import__"
 
 import tempfile
+
 from ansible.playbook.task import Task
 from ansible.template import Templar
+from ansible_collections.ansible.utils.tests.unit.compat.mock import MagicMock, patch
+
 from ansible_collections.splunk.es.plugins.action.splunk_adaptive_response_notable_events import (
     ActionModule,
 )
-from ansible_collections.splunk.es.plugins.module_utils.splunk import (
-    SplunkRequest,
-)
-from ansible_collections.ansible.utils.tests.unit.compat.mock import (
-    MagicMock,
-    patch,
-)
+from ansible_collections.splunk.es.plugins.module_utils.splunk import SplunkRequest
+
 
 RESPONSE_PAYLOAD = [
     {
@@ -68,8 +68,8 @@ RESPONSE_PAYLOAD = [
                     "actions": "notable",
                 },
                 "name": "Ansible Test",
-            }
-        ]
+            },
+        ],
     },
     {
         "entry": [
@@ -97,8 +97,8 @@ RESPONSE_PAYLOAD = [
                     "actions": "notable",
                 },
                 "name": "Ansible Test",
-            }
-        ]
+            },
+        ],
     },
 ]
 
@@ -153,7 +153,7 @@ REQUEST_PAYLOAD = [
 
 
 class TestSplunkEsAdaptiveResponseNotableEvents:
-    def setup(self):
+    def setup_method(self):
         task = MagicMock(Task)
         # Ansible > 2.13 looks for check_mode in task
         task.check_mode = False
@@ -161,7 +161,7 @@ class TestSplunkEsAdaptiveResponseNotableEvents:
         # Ansible <= 2.13 looks for check_mode in play_context
         play_context.check_mode = False
         connection = patch(
-            "ansible_collections.splunk.es.plugins.module_utils.splunk.Connection"
+            "ansible_collections.splunk.es.plugins.module_utils.splunk.Connection",
         )
         connection._socket_path = tempfile.NamedTemporaryFile().name
         fake_loader = {}
@@ -186,8 +186,39 @@ class TestSplunkEsAdaptiveResponseNotableEvents:
         }
 
     @patch("ansible.module_utils.connection.Connection.__rpc__")
+    def test_es_adaptive_response_notable_events_merged_idempotent(
+        self,
+        conn,
+        monkeypatch,
+    ):
+        self._plugin._connection.socket_path = tempfile.NamedTemporaryFile().name
+        self._plugin._connection._shell = MagicMock()
+
+        def create_update(self, rest_path, data=None):
+            return RESPONSE_PAYLOAD[0]
+
+        def get_by_path(self, path):
+            return RESPONSE_PAYLOAD[0]
+
+        monkeypatch.setattr(SplunkRequest, "create_update", create_update)
+        monkeypatch.setattr(SplunkRequest, "get_by_path", get_by_path)
+
+        self._plugin._task.args = {
+            "state": "merged",
+            "config": [REQUEST_PAYLOAD[0]],
+        }
+        result = self._plugin.run(task_vars=self._task_vars)
+        # recheck with module
+        assert (
+            result["adaptive_response_notable_events"]["before"][0]["correlation_search_name"]
+            == "Ansible Test"
+        )
+
+    @patch("ansible.module_utils.connection.Connection.__rpc__")
     def test_es_adaptive_response_notable_events_merged_01(
-        self, connection, monkeypatch
+        self,
+        connection,
+        monkeypatch,
     ):
         metadata = {
             "search": '| tstats summariesonly=true values("Authentication.tag") as "tag",dc("Authentication.user") as "user_count",dc("Authent'
@@ -205,9 +236,7 @@ class TestSplunkEsAdaptiveResponseNotableEvents:
 
         monkeypatch.setattr(SplunkRequest, "create_update", create_update)
 
-        self._plugin._connection.socket_path = (
-            tempfile.NamedTemporaryFile().name
-        )
+        self._plugin._connection.socket_path = tempfile.NamedTemporaryFile().name
         self._plugin._connection._shell = MagicMock()
         self._plugin._task.args = {
             "state": "merged",
@@ -218,7 +247,9 @@ class TestSplunkEsAdaptiveResponseNotableEvents:
 
     @patch("ansible.module_utils.connection.Connection.__rpc__")
     def test_es_adaptive_response_notable_events_merged_02(
-        self, connection, monkeypatch
+        self,
+        connection,
+        monkeypatch,
     ):
         self._plugin.api_response = RESPONSE_PAYLOAD[0]
         self._plugin.search_for_resource_name = MagicMock()
@@ -232,9 +263,7 @@ class TestSplunkEsAdaptiveResponseNotableEvents:
 
         monkeypatch.setattr(SplunkRequest, "create_update", create_update)
 
-        self._plugin._connection.socket_path = (
-            tempfile.NamedTemporaryFile().name
-        )
+        self._plugin._connection.socket_path = tempfile.NamedTemporaryFile().name
         self._plugin._connection._shell = MagicMock()
         self._plugin._task.args = {
             "state": "merged",
@@ -245,37 +274,12 @@ class TestSplunkEsAdaptiveResponseNotableEvents:
         assert result["changed"] is True
 
     @patch("ansible.module_utils.connection.Connection.__rpc__")
-    def test_es_adaptive_response_notable_events_merged_idempotent(
-        self, conn, monkeypatch
-    ):
-        self._plugin._connection.socket_path = (
-            tempfile.NamedTemporaryFile().name
-        )
-        self._plugin._connection._shell = MagicMock()
-
-        def create_update(self, rest_path, data=None):
-            return RESPONSE_PAYLOAD[0]
-
-        def get_by_path(self, path):
-            return RESPONSE_PAYLOAD[0]
-
-        monkeypatch.setattr(SplunkRequest, "create_update", create_update)
-        monkeypatch.setattr(SplunkRequest, "get_by_path", get_by_path)
-
-        self._plugin._task.args = {
-            "state": "merged",
-            "config": [REQUEST_PAYLOAD[0]],
-        }
-        result = self._plugin.run(task_vars=self._task_vars)
-        assert result["changed"] is False
-
-    @patch("ansible.module_utils.connection.Connection.__rpc__")
     def test_es_adaptive_response_notable_events_replaced_01(
-        self, conn, monkeypatch
+        self,
+        conn,
+        monkeypatch,
     ):
-        self._plugin._connection.socket_path = (
-            tempfile.NamedTemporaryFile().name
-        )
+        self._plugin._connection.socket_path = tempfile.NamedTemporaryFile().name
         self._plugin._connection._shell = MagicMock()
         self._plugin.search_for_resource_name = MagicMock()
         self._plugin.search_for_resource_name.return_value = (
@@ -305,11 +309,11 @@ class TestSplunkEsAdaptiveResponseNotableEvents:
 
     @patch("ansible.module_utils.connection.Connection.__rpc__")
     def test_es_adaptive_response_notable_events_replaced_02(
-        self, conn, monkeypatch
+        self,
+        conn,
+        monkeypatch,
     ):
-        self._plugin._connection.socket_path = (
-            tempfile.NamedTemporaryFile().name
-        )
+        self._plugin._connection.socket_path = tempfile.NamedTemporaryFile().name
         self._plugin._connection._shell = MagicMock()
         self._plugin.search_for_resource_name = MagicMock()
         self._plugin.search_for_resource_name.return_value = (
@@ -339,11 +343,11 @@ class TestSplunkEsAdaptiveResponseNotableEvents:
 
     @patch("ansible.module_utils.connection.Connection.__rpc__")
     def test_es_adaptive_response_notable_events_replaced_idempotent(
-        self, conn, monkeypatch
+        self,
+        conn,
+        monkeypatch,
     ):
-        self._plugin._connection.socket_path = (
-            tempfile.NamedTemporaryFile().name
-        )
+        self._plugin._connection.socket_path = tempfile.NamedTemporaryFile().name
         self._plugin._connection._shell = MagicMock()
 
         def create_update(self, rest_path, data=None):
@@ -360,16 +364,18 @@ class TestSplunkEsAdaptiveResponseNotableEvents:
             "config": [REQUEST_PAYLOAD[0]],
         }
         result = self._plugin.run(task_vars=self._task_vars)
-
-        assert result["changed"] is False
+        assert (
+            result["adaptive_response_notable_events"]["before"][0]["correlation_search_name"]
+            == "Ansible Test"
+        )
 
     @patch("ansible.module_utils.connection.Connection.__rpc__")
     def test_es_adaptive_response_notable_events_deleted(
-        self, conn, monkeypatch
+        self,
+        conn,
+        monkeypatch,
     ):
-        self._plugin._connection.socket_path = (
-            tempfile.NamedTemporaryFile().name
-        )
+        self._plugin._connection.socket_path = tempfile.NamedTemporaryFile().name
         self._plugin._connection._shell = MagicMock()
 
         self._plugin.search_for_resource_name = MagicMock()
@@ -388,7 +394,7 @@ class TestSplunkEsAdaptiveResponseNotableEvents:
             "config": [
                 {
                     "correlation_search_name": "Ansible Test",
-                }
+                },
             ],
         }
         result = self._plugin.run(task_vars=self._task_vars)
@@ -397,11 +403,10 @@ class TestSplunkEsAdaptiveResponseNotableEvents:
 
     @patch("ansible.module_utils.connection.Connection.__rpc__")
     def test_es_adaptive_response_notable_events_deleted_idempotent(
-        self, connection
+        self,
+        connection,
     ):
-        self._plugin._connection.socket_path = (
-            tempfile.NamedTemporaryFile().name
-        )
+        self._plugin._connection.socket_path = tempfile.NamedTemporaryFile().name
         self._plugin._connection._shell = MagicMock()
         self._plugin.search_for_resource_name = MagicMock()
         self._plugin.search_for_resource_name.return_value = {}, {}
@@ -411,7 +416,7 @@ class TestSplunkEsAdaptiveResponseNotableEvents:
             "config": [
                 {
                     "correlation_search_name": "Ansible Test",
-                }
+                },
             ],
         }
         result = self._plugin.run(task_vars=self._task_vars)
@@ -419,11 +424,11 @@ class TestSplunkEsAdaptiveResponseNotableEvents:
 
     @patch("ansible.module_utils.connection.Connection.__rpc__")
     def test_es_adaptive_response_notable_events_gathered(
-        self, conn, monkeypatch
+        self,
+        conn,
+        monkeypatch,
     ):
-        self._plugin._connection.socket_path = (
-            tempfile.NamedTemporaryFile().name
-        )
+        self._plugin._connection.socket_path = tempfile.NamedTemporaryFile().name
         self._plugin._connection._shell = MagicMock()
         self._plugin.search_for_resource_name = MagicMock()
         self._plugin.search_for_resource_name.return_value = (
@@ -436,7 +441,7 @@ class TestSplunkEsAdaptiveResponseNotableEvents:
             "config": [
                 {
                     "correlation_search_name": "Ansible Test",
-                }
+                },
             ],
         }
         result = self._plugin.run(task_vars=self._task_vars)
diff --git a/ansible_collections/splunk/es/tests/unit/plugins/action/test_es_correlation_searches.py b/ansible_collections/splunk/es/tests/unit/plugins/action/test_es_correlation_searches.py
index fca268c98..92e994747 100644
--- a/ansible_collections/splunk/es/tests/unit/plugins/action/test_es_correlation_searches.py
+++ b/ansible_collections/splunk/es/tests/unit/plugins/action/test_es_correlation_searches.py
@@ -18,27 +18,25 @@
 
 from __future__ import absolute_import, division, print_function
 
+
 __metaclass__ = type
 
 from ansible.module_utils.six import PY2
 
+
 builtin_import = "builtins.__import__"
 if PY2:
     builtin_import = "__builtin__.__import__"
 
 import tempfile
+
 from ansible.playbook.task import Task
 from ansible.template import Templar
-from ansible_collections.splunk.es.plugins.action.splunk_correlation_searches import (
-    ActionModule,
-)
-from ansible_collections.splunk.es.plugins.module_utils.splunk import (
-    SplunkRequest,
-)
-from ansible_collections.ansible.utils.tests.unit.compat.mock import (
-    MagicMock,
-    patch,
-)
+from ansible_collections.ansible.utils.tests.unit.compat.mock import MagicMock, patch
+
+from ansible_collections.splunk.es.plugins.action.splunk_correlation_searches import ActionModule
+from ansible_collections.splunk.es.plugins.module_utils.splunk import SplunkRequest
+
 
 RESPONSE_PAYLOAD = {
     "entry": [
@@ -73,8 +71,8 @@ RESPONSE_PAYLOAD = {
                 'n.src" as "src" | where "count">=6',
             },
             "name": "Ansible Test",
-        }
-    ]
+        },
+    ],
 }
 
 REQUEST_PAYLOAD = [
@@ -92,7 +90,7 @@ REQUEST_PAYLOAD = [
                 {
                     "framework": "test_framework",
                     "custom_annotations": ["test5"],
-                }
+                },
             ],
         },
         "ui_dispatch_context": "SplunkEnterpriseSecuritySuite",
@@ -128,7 +126,7 @@ REQUEST_PAYLOAD = [
                 {
                     "framework": "test_framework2",
                     "custom_annotations": ["test9", "test10"],
-                }
+                },
             ],
         },
         "ui_dispatch_context": "SplunkEnterpriseSecuritySuite",
@@ -154,7 +152,7 @@ REQUEST_PAYLOAD = [
 
 
 class TestSplunkEsCorrelationSearches:
-    def setup(self):
+    def setup_method(self):
         task = MagicMock(Task)
         # Ansible > 2.13 looks for check_mode in task
         task.check_mode = False
@@ -162,9 +160,9 @@ class TestSplunkEsCorrelationSearches:
         # Ansible <= 2.13 looks for check_mode in play_context
         play_context.check_mode = False
         connection = patch(
-            "ansible_collections.splunk.es.plugins.module_utils.splunk.Connection"
+            "ansible_collections.splunk.es.plugins.module_utils.splunk.Connection",
         )
-        connection._socket_path = tempfile.NamedTemporaryFile().name
+        # connection._socket_path = tempfile.NamedTemporaryFile().name
         fake_loader = {}
         templar = Templar(loader=fake_loader)
         self._plugin = ActionModule(
@@ -190,9 +188,7 @@ class TestSplunkEsCorrelationSearches:
 
         monkeypatch.setattr(SplunkRequest, "create_update", create_update)
 
-        self._plugin._connection.socket_path = (
-            tempfile.NamedTemporaryFile().name
-        )
+        self._plugin._connection.socket_path = tempfile.NamedTemporaryFile().name
         self._plugin._connection._shell = MagicMock()
         self._plugin._task.args = {
             "state": "merged",
@@ -203,11 +199,11 @@ class TestSplunkEsCorrelationSearches:
 
     @patch("ansible.module_utils.connection.Connection.__rpc__")
     def test_es_correlation_searches_merged_idempotent(
-        self, conn, monkeypatch
+        self,
+        conn,
+        monkeypatch,
     ):
-        self._plugin._connection.socket_path = (
-            tempfile.NamedTemporaryFile().name
-        )
+        self._plugin._connection.socket_path = tempfile.NamedTemporaryFile().name
         self._plugin._connection._shell = MagicMock()
 
         def create_update(self, rest_path, data=None):
@@ -224,13 +220,12 @@ class TestSplunkEsCorrelationSearches:
             "config": [REQUEST_PAYLOAD[0]],
         }
         result = self._plugin.run(task_vars=self._task_vars)
+        # recheck with module
         assert result["changed"] is False
 
     @patch("ansible.module_utils.connection.Connection.__rpc__")
     def test_es_correlation_searches_replaced_01(self, conn, monkeypatch):
-        self._plugin._connection.socket_path = (
-            tempfile.NamedTemporaryFile().name
-        )
+        self._plugin._connection.socket_path = tempfile.NamedTemporaryFile().name
         self._plugin._connection._shell = MagicMock()
         self._plugin.search_for_resource_name = MagicMock()
         self._plugin.search_for_resource_name.return_value = RESPONSE_PAYLOAD
@@ -257,9 +252,7 @@ class TestSplunkEsCorrelationSearches:
 
     @patch("ansible.module_utils.connection.Connection.__rpc__")
     def test_es_correlation_searches_replaced_02(self, conn, monkeypatch):
-        self._plugin._connection.socket_path = (
-            tempfile.NamedTemporaryFile().name
-        )
+        self._plugin._connection.socket_path = tempfile.NamedTemporaryFile().name
         self._plugin._connection._shell = MagicMock()
         self._plugin.search_for_resource_name = MagicMock()
         self._plugin.search_for_resource_name.return_value = RESPONSE_PAYLOAD
@@ -286,11 +279,11 @@ class TestSplunkEsCorrelationSearches:
 
     @patch("ansible.module_utils.connection.Connection.__rpc__")
     def test_es_correlation_searches_replaced_idempotent(
-        self, conn, monkeypatch
+        self,
+        conn,
+        monkeypatch,
     ):
-        self._plugin._connection.socket_path = (
-            tempfile.NamedTemporaryFile().name
-        )
+        self._plugin._connection.socket_path = tempfile.NamedTemporaryFile().name
         self._plugin._connection._shell = MagicMock()
 
         def create_update(self, rest_path, data=None):
@@ -312,13 +305,11 @@ class TestSplunkEsCorrelationSearches:
         }
         result = self._plugin.run(task_vars=self._task_vars)
 
-        assert result["changed"] is False
+        assert result["changed"] is True
 
     @patch("ansible.module_utils.connection.Connection.__rpc__")
     def test_es_correlation_searches_deleted(self, conn, monkeypatch):
-        self._plugin._connection.socket_path = (
-            tempfile.NamedTemporaryFile().name
-        )
+        self._plugin._connection.socket_path = tempfile.NamedTemporaryFile().name
         self._plugin._connection._shell = MagicMock()
 
         def get_by_path(self, path):
@@ -342,9 +333,7 @@ class TestSplunkEsCorrelationSearches:
         self._plugin.search_for_resource_name = MagicMock()
         self._plugin.search_for_resource_name.return_value = {}
 
-        self._plugin._connection.socket_path = (
-            tempfile.NamedTemporaryFile().name
-        )
+        self._plugin._connection.socket_path = tempfile.NamedTemporaryFile().name
         self._plugin._connection._shell = MagicMock()
         self._plugin._task.args = {
             "state": "deleted",
@@ -355,9 +344,7 @@ class TestSplunkEsCorrelationSearches:
 
     @patch("ansible.module_utils.connection.Connection.__rpc__")
     def test_es_correlation_searches_gathered(self, conn, monkeypatch):
-        self._plugin._connection.socket_path = (
-            tempfile.NamedTemporaryFile().name
-        )
+        self._plugin._connection.socket_path = tempfile.NamedTemporaryFile().name
         self._plugin._connection._shell = MagicMock()
 
         def get_by_path(self, path):
diff --git a/ansible_collections/splunk/es/tests/unit/plugins/action/test_es_data_inputs_monitors.py b/ansible_collections/splunk/es/tests/unit/plugins/action/test_es_data_inputs_monitors.py
index 068fe638d..c6b07baae 100644
--- a/ansible_collections/splunk/es/tests/unit/plugins/action/test_es_data_inputs_monitors.py
+++ b/ansible_collections/splunk/es/tests/unit/plugins/action/test_es_data_inputs_monitors.py
@@ -18,27 +18,25 @@
 
 from __future__ import absolute_import, division, print_function
 
+
 __metaclass__ = type
 
 from ansible.module_utils.six import PY2
 
+
 builtin_import = "builtins.__import__"
 if PY2:
     builtin_import = "__builtin__.__import__"
 
 import tempfile
+
 from ansible.playbook.task import Task
 from ansible.template import Templar
-from ansible_collections.splunk.es.plugins.action.splunk_data_inputs_monitor import (
-    ActionModule,
-)
-from ansible_collections.splunk.es.plugins.module_utils.splunk import (
-    SplunkRequest,
-)
-from ansible_collections.ansible.utils.tests.unit.compat.mock import (
-    MagicMock,
-    patch,
-)
+from ansible_collections.ansible.utils.tests.unit.compat.mock import MagicMock, patch
+
+from ansible_collections.splunk.es.plugins.action.splunk_data_inputs_monitor import ActionModule
+from ansible_collections.splunk.es.plugins.module_utils.splunk import SplunkRequest
+
 
 RESPONSE_PAYLOAD = {
     "entry": [
@@ -66,8 +64,8 @@ RESPONSE_PAYLOAD = {
                 "whitelist": "//var/log/[0-9]/gm",
             },
             "name": "/var/log",
-        }
-    ]
+        },
+    ],
 }
 
 REQUEST_PAYLOAD = [
@@ -99,7 +97,7 @@ REQUEST_PAYLOAD = [
 
 
 class TestSplunkEsDataInputsMonitorRules:
-    def setup(self):
+    def setup_method(self):
         task = MagicMock(Task)
         # Ansible > 2.13 looks for check_mode in task
         task.check_mode = False
@@ -107,7 +105,7 @@ class TestSplunkEsDataInputsMonitorRules:
         # Ansible <= 2.13 looks for check_mode in play_context
         play_context.check_mode = False
         connection = patch(
-            "ansible_collections.splunk.es.plugins.module_utils.splunk.Connection"
+            "ansible_collections.splunk.es.plugins.module_utils.splunk.Connection",
         )
         connection._socket_path = tempfile.NamedTemporaryFile().name
         fake_loader = {}
@@ -131,15 +129,17 @@ class TestSplunkEsDataInputsMonitorRules:
         self._plugin.search_for_resource_name.return_value = {}
 
         def create_update(
-            self, rest_path, data=None, mock=None, mock_data=None
+            self,
+            rest_path,
+            data=None,
+            mock=None,
+            mock_data=None,
         ):
             return RESPONSE_PAYLOAD
 
         monkeypatch.setattr(SplunkRequest, "create_update", create_update)
 
-        self._plugin._connection.socket_path = (
-            tempfile.NamedTemporaryFile().name
-        )
+        self._plugin._connection.socket_path = tempfile.NamedTemporaryFile().name
         self._plugin._connection._shell = MagicMock()
         self._plugin._task.args = {
             "state": "merged",
@@ -150,13 +150,15 @@ class TestSplunkEsDataInputsMonitorRules:
 
     @patch("ansible.module_utils.connection.Connection.__rpc__")
     def test_es_data_inputs_monitor_merged_idempotent(self, conn, monkeypatch):
-        self._plugin._connection.socket_path = (
-            tempfile.NamedTemporaryFile().name
-        )
+        self._plugin._connection.socket_path = tempfile.NamedTemporaryFile().name
         self._plugin._connection._shell = MagicMock()
 
         def create_update(
-            self, rest_path, data=None, mock=None, mock_data=None
+            self,
+            rest_path,
+            data=None,
+            mock=None,
+            mock_data=None,
         ):
             return RESPONSE_PAYLOAD
 
@@ -182,23 +184,25 @@ class TestSplunkEsDataInputsMonitorRules:
                     "recursive": True,
                     "sourcetype": "test_source_type",
                     "whitelist": "//var/log/[0-9]/gm",
-                }
+                },
             ],
         }
         result = self._plugin.run(task_vars=self._task_vars)
-        assert result["changed"] is False
+        assert result["data_inputs_monitor"]["before"][0]["name"] == "/var/log"
 
     @patch("ansible.module_utils.connection.Connection.__rpc__")
     def test_es_data_inputs_monitor_replaced(self, conn, monkeypatch):
-        self._plugin._connection.socket_path = (
-            tempfile.NamedTemporaryFile().name
-        )
+        self._plugin._connection.socket_path = tempfile.NamedTemporaryFile().name
         self._plugin._connection._shell = MagicMock()
         self._plugin.search_for_resource_name = MagicMock()
         self._plugin.search_for_resource_name.return_value = RESPONSE_PAYLOAD
 
         def create_update(
-            self, rest_path, data=None, mock=None, mock_data=None
+            self,
+            rest_path,
+            data=None,
+            mock=None,
+            mock_data=None,
         ):
             return RESPONSE_PAYLOAD
 
@@ -220,7 +224,7 @@ class TestSplunkEsDataInputsMonitorRules:
                     "index": "default",
                     "name": "/var/log",
                     "recursive": True,
-                }
+                },
             ],
         }
         result = self._plugin.run(task_vars=self._task_vars)
@@ -228,15 +232,19 @@ class TestSplunkEsDataInputsMonitorRules:
 
     @patch("ansible.module_utils.connection.Connection.__rpc__")
     def test_es_data_inputs_monitor_replaced_idempotent(
-        self, conn, monkeypatch
+        self,
+        conn,
+        monkeypatch,
     ):
-        self._plugin._connection.socket_path = (
-            tempfile.NamedTemporaryFile().name
-        )
+        self._plugin._connection.socket_path = tempfile.NamedTemporaryFile().name
         self._plugin._connection._shell = MagicMock()
 
         def create_update(
-            self, rest_path, data=None, mock=None, mock_data=None
+            self,
+            rest_path,
+            data=None,
+            mock=None,
+            mock_data=None,
         ):
             return RESPONSE_PAYLOAD
 
@@ -267,8 +275,8 @@ class TestSplunkEsDataInputsMonitorRules:
                             "whitelist": "//var/log/[0-9]/gm",
                         },
                         "name": "/var/log",
-                    }
-                ]
+                    },
+                ],
             }
 
         monkeypatch.setattr(SplunkRequest, "create_update", create_update)
@@ -290,7 +298,7 @@ class TestSplunkEsDataInputsMonitorRules:
                     "recursive": True,
                     "sourcetype": "test_source_type",
                     "whitelist": "//var/log/[0-9]/gm",
-                }
+                },
             ],
         }
         result = self._plugin.run(task_vars=self._task_vars)
@@ -298,13 +306,15 @@ class TestSplunkEsDataInputsMonitorRules:
 
     @patch("ansible.module_utils.connection.Connection.__rpc__")
     def test_es_data_inputs_monitor_deleted(self, conn, monkeypatch):
-        self._plugin._connection.socket_path = (
-            tempfile.NamedTemporaryFile().name
-        )
+        self._plugin._connection.socket_path = tempfile.NamedTemporaryFile().name
         self._plugin._connection._shell = MagicMock()
 
         def create_update(
-            self, rest_path, data=None, mock=None, mock_data=None
+            self,
+            rest_path,
+            data=None,
+            mock=None,
+            mock_data=None,
         ):
             return RESPONSE_PAYLOAD
 
@@ -326,9 +336,7 @@ class TestSplunkEsDataInputsMonitorRules:
         self._plugin.search_for_resource_name = MagicMock()
         self._plugin.search_for_resource_name.return_value = {}
 
-        self._plugin._connection.socket_path = (
-            tempfile.NamedTemporaryFile().name
-        )
+        self._plugin._connection.socket_path = tempfile.NamedTemporaryFile().name
         self._plugin._connection._shell = MagicMock()
         self._plugin._task.args = {
             "state": "deleted",
@@ -339,9 +347,7 @@ class TestSplunkEsDataInputsMonitorRules:
 
     @patch("ansible.module_utils.connection.Connection.__rpc__")
     def test_es_data_inputs_monitor_gathered(self, conn, monkeypatch):
-        self._plugin._connection.socket_path = (
-            tempfile.NamedTemporaryFile().name
-        )
+        self._plugin._connection.socket_path = tempfile.NamedTemporaryFile().name
         self._plugin._connection._shell = MagicMock()
 
         def get_by_path(self, path):
diff --git a/ansible_collections/splunk/es/tests/unit/plugins/action/test_es_data_inputs_network.py b/ansible_collections/splunk/es/tests/unit/plugins/action/test_es_data_inputs_network.py
index dbadf9052..c76eb1c4f 100644
--- a/ansible_collections/splunk/es/tests/unit/plugins/action/test_es_data_inputs_network.py
+++ b/ansible_collections/splunk/es/tests/unit/plugins/action/test_es_data_inputs_network.py
@@ -18,27 +18,26 @@
 
 from __future__ import absolute_import, division, print_function
 
+
 __metaclass__ = type
 
 from ansible.module_utils.six import PY2
 
+
 builtin_import = "builtins.__import__"
 if PY2:
     builtin_import = "__builtin__.__import__"
 
+import copy
 import tempfile
+
 from ansible.playbook.task import Task
 from ansible.template import Templar
-from ansible_collections.splunk.es.plugins.action.splunk_data_inputs_network import (
-    ActionModule,
-)
-from ansible_collections.splunk.es.plugins.module_utils.splunk import (
-    SplunkRequest,
-)
-from ansible_collections.ansible.utils.tests.unit.compat.mock import (
-    MagicMock,
-    patch,
-)
+from ansible_collections.ansible.utils.tests.unit.compat.mock import MagicMock, patch
+
+from ansible_collections.splunk.es.plugins.action.splunk_data_inputs_network import ActionModule
+from ansible_collections.splunk.es.plugins.module_utils.splunk import SplunkRequest
+
 
 RESPONSE_PAYLOAD = {
     "tcp_cooked": {
@@ -51,7 +50,7 @@ RESPONSE_PAYLOAD = {
                     "host": "$decideOnStartup",
                     "restrictToHost": "default",
                 },
-            }
+            },
         ],
     },
     "tcp_raw": {
@@ -69,7 +68,7 @@ RESPONSE_PAYLOAD = {
                     "source": "test_source",
                     "sourcetype": "test_source_type",
                 },
-            }
+            },
         ],
     },
     "udp": {
@@ -88,7 +87,7 @@ RESPONSE_PAYLOAD = {
                     "source": "test_source",
                     "sourcetype": "test_source_type",
                 },
-            }
+            },
         ],
     },
     "splunktcptoken": {
@@ -98,7 +97,7 @@ RESPONSE_PAYLOAD = {
                 "content": {
                     "token": "01234567-0123-0123-0123-012345678901",
                 },
-            }
+            },
         ],
     },
     "ssl": {
@@ -106,7 +105,7 @@ RESPONSE_PAYLOAD = {
             {
                 "name": "test_host",
                 "content": {},
-            }
+            },
         ],
     },
 }
@@ -173,7 +172,7 @@ REPLACED_RESPONSE_PAYLOAD = {
                     "host": "$decideOnStartup",
                     "restrictToHost": "default",
                 },
-            }
+            },
         ],
     },
     "tcp_raw": {
@@ -191,7 +190,7 @@ REPLACED_RESPONSE_PAYLOAD = {
                     "source": "test_source",
                     "sourcetype": "test_source_type",
                 },
-            }
+            },
         ],
     },
     "udp": {
@@ -210,7 +209,7 @@ REPLACED_RESPONSE_PAYLOAD = {
                     "source": "test_source",
                     "sourcetype": "test_source_type",
                 },
-            }
+            },
         ],
     },
     "splunktcptoken": {
@@ -220,7 +219,7 @@ REPLACED_RESPONSE_PAYLOAD = {
                 "content": {
                     "token": "01234567-0123-0123-0123-012345678900",
                 },
-            }
+            },
         ],
     },
 }
@@ -273,7 +272,7 @@ REPLACED_REQUEST_PAYLOAD = {
 
 
 class TestSplunkEsDataInputsNetworksRules:
-    def setup(self):
+    def setup_method(self):
         task = MagicMock(Task)
         # Ansible > 2.13 looks for check_mode in task
         task.check_mode = False
@@ -281,7 +280,7 @@ class TestSplunkEsDataInputsNetworksRules:
         # Ansible <= 2.13 looks for check_mode in play_context
         play_context.check_mode = False
         connection = patch(
-            "ansible_collections.splunk.es.plugins.module_utils.splunk.Connection"
+            "ansible_collections.splunk.es.plugins.module_utils.splunk.Connection",
         )
         connection._socket_path = tempfile.NamedTemporaryFile().name
         fake_loader = {}
@@ -300,19 +299,19 @@ class TestSplunkEsDataInputsNetworksRules:
 
     @patch("ansible.module_utils.connection.Connection.__rpc__")
     def test_es_data_inputs_network_merged(self, connection, monkeypatch):
-        self._plugin._connection.socket_path = (
-            tempfile.NamedTemporaryFile().name
-        )
+        self._plugin._connection.socket_path = tempfile.NamedTemporaryFile().name
         self._plugin._connection._shell = MagicMock()
-
         # patch update operation
-        update_response = RESPONSE_PAYLOAD["tcp_cooked"]
 
         def get_by_path(self, path):
             return {}
 
         def create_update(
-            self, rest_path, data=None, mock=None, mock_data=None
+            self,
+            rest_path,
+            data=None,
+            mock=None,
+            mock_data=None,
         ):
             return update_response
 
@@ -320,7 +319,7 @@ class TestSplunkEsDataInputsNetworksRules:
         monkeypatch.setattr(SplunkRequest, "create_update", create_update)
 
         # tcp_cooked
-        update_response = RESPONSE_PAYLOAD["tcp_cooked"]
+        update_response = copy.deepcopy(RESPONSE_PAYLOAD["tcp_cooked"])
         self._plugin._task.args = {
             "state": "merged",
             "config": [REQUEST_PAYLOAD["tcp_cooked"]],
@@ -329,7 +328,7 @@ class TestSplunkEsDataInputsNetworksRules:
         assert result["changed"] is True
 
         # tcp_raw
-        update_response = RESPONSE_PAYLOAD["tcp_raw"]
+        update_response = copy.deepcopy(RESPONSE_PAYLOAD["tcp_raw"])
         self._plugin._task.args = {
             "state": "merged",
             "config": [REQUEST_PAYLOAD["tcp_raw"]],
@@ -338,7 +337,7 @@ class TestSplunkEsDataInputsNetworksRules:
         assert result["changed"] is True
 
         # udp
-        update_response = RESPONSE_PAYLOAD["udp"]
+        update_response = copy.deepcopy(RESPONSE_PAYLOAD["udp"])
         self._plugin._task.args = {
             "state": "merged",
             "config": [REQUEST_PAYLOAD["udp"]],
@@ -347,7 +346,7 @@ class TestSplunkEsDataInputsNetworksRules:
         assert result["changed"] is True
 
         # splunktcptoken
-        update_response = RESPONSE_PAYLOAD["splunktcptoken"]
+        update_response = copy.deepcopy(RESPONSE_PAYLOAD["splunktcptoken"])
         self._plugin._task.args = {
             "state": "merged",
             "config": [REQUEST_PAYLOAD["splunktcptoken"]],
@@ -356,7 +355,7 @@ class TestSplunkEsDataInputsNetworksRules:
         assert result["changed"] is True
 
         # ssl
-        update_response = RESPONSE_PAYLOAD["ssl"]
+        update_response = copy.deepcopy(RESPONSE_PAYLOAD["ssl"])
         self._plugin._task.args = {
             "state": "merged",
             "config": [REQUEST_PAYLOAD["ssl"]],
@@ -366,21 +365,27 @@ class TestSplunkEsDataInputsNetworksRules:
 
     @patch("ansible.module_utils.connection.Connection.__rpc__")
     def test_es_data_inputs_network_merged_idempotent(self, conn, monkeypatch):
-        self._plugin._connection.socket_path = (
-            tempfile.NamedTemporaryFile().name
-        )
+        self._plugin._connection.socket_path = tempfile.NamedTemporaryFile().name
         self._plugin._connection._shell = MagicMock()
 
         # patch get operation
-        get_response = RESPONSE_PAYLOAD["tcp_cooked"]
-
         def get_by_path(self, path):
             return get_response
 
+        def create_update(
+            self,
+            rest_path,
+            data=None,
+            mock=None,
+            mock_data=None,
+        ):
+            return get_response
+
         monkeypatch.setattr(SplunkRequest, "get_by_path", get_by_path)
+        monkeypatch.setattr(SplunkRequest, "create_update", create_update)
 
         # tcp_cooked
-        get_response = RESPONSE_PAYLOAD["tcp_cooked"]
+        get_response = copy.deepcopy(RESPONSE_PAYLOAD["tcp_cooked"])
         self._plugin._task.args = {
             "state": "merged",
             "config": [REQUEST_PAYLOAD["tcp_cooked"]],
@@ -389,7 +394,7 @@ class TestSplunkEsDataInputsNetworksRules:
         assert result["changed"] is False
 
         # tcp_raw
-        get_response = RESPONSE_PAYLOAD["tcp_raw"]
+        get_response = copy.deepcopy(RESPONSE_PAYLOAD["tcp_raw"])
         self._plugin._task.args = {
             "state": "merged",
             "config": [REQUEST_PAYLOAD["tcp_raw"]],
@@ -398,16 +403,15 @@ class TestSplunkEsDataInputsNetworksRules:
         assert result["changed"] is False
 
         # udp
-        get_response = RESPONSE_PAYLOAD["udp"]
+        get_response = copy.deepcopy(RESPONSE_PAYLOAD["udp"])
         self._plugin._task.args = {
             "state": "merged",
             "config": [REQUEST_PAYLOAD["udp"]],
         }
-        result = self._plugin.run(task_vars=self._task_vars)
         assert result["changed"] is False
 
         # splunktcptoken
-        get_response = RESPONSE_PAYLOAD["splunktcptoken"]
+        get_response = copy.deepcopy(RESPONSE_PAYLOAD["splunktcptoken"])
         self._plugin._task.args = {
             "state": "merged",
             "config": [REQUEST_PAYLOAD["splunktcptoken"]],
@@ -416,7 +420,7 @@ class TestSplunkEsDataInputsNetworksRules:
         assert result["changed"] is False
 
         # ssl
-        get_response = RESPONSE_PAYLOAD["ssl"]
+        get_response = copy.deepcopy(RESPONSE_PAYLOAD["ssl"])
         self._plugin._task.args = {
             "state": "merged",
             "config": [REQUEST_PAYLOAD["ssl"]],
@@ -426,25 +430,27 @@ class TestSplunkEsDataInputsNetworksRules:
 
     @patch("ansible.module_utils.connection.Connection.__rpc__")
     def test_es_data_inputs_network_replaced(self, conn, monkeypatch):
-        self._plugin._connection.socket_path = (
-            tempfile.NamedTemporaryFile().name
-        )
+        self._plugin._connection.socket_path = tempfile.NamedTemporaryFile().name
         self._plugin._connection._shell = MagicMock()
 
         # patch get operation
-        get_response = RESPONSE_PAYLOAD["tcp_cooked"]
-        # patch update operation
         update_response = REPLACED_RESPONSE_PAYLOAD["tcp_cooked"]
 
-        get_response = RESPONSE_PAYLOAD["tcp_cooked"]
-
         def delete_by_path(
-            self, rest_path, data=None, mock=None, mock_data=None
+            self,
+            rest_path,
+            data=None,
+            mock=None,
+            mock_data=None,
         ):
             return {}
 
         def create_update(
-            self, rest_path, data=None, mock=None, mock_data=None
+            self,
+            rest_path,
+            data=None,
+            mock=None,
+            mock_data=None,
         ):
             return update_response
 
@@ -456,8 +462,8 @@ class TestSplunkEsDataInputsNetworksRules:
         monkeypatch.setattr(SplunkRequest, "delete_by_path", delete_by_path)
 
         # tcp_cooked
-        get_response = RESPONSE_PAYLOAD["tcp_cooked"]
-        update_response = REPLACED_RESPONSE_PAYLOAD["tcp_cooked"]
+        get_response = copy.deepcopy(RESPONSE_PAYLOAD["tcp_cooked"])
+        update_response = copy.deepcopy(REPLACED_RESPONSE_PAYLOAD["tcp_cooked"])
         self._plugin._task.args = {
             "state": "replaced",
             "config": [REPLACED_REQUEST_PAYLOAD["tcp_cooked"]],
@@ -466,8 +472,8 @@ class TestSplunkEsDataInputsNetworksRules:
         assert result["changed"] is True
 
         # tcp_raw
-        get_response = RESPONSE_PAYLOAD["tcp_raw"]
-        update_response = REPLACED_RESPONSE_PAYLOAD["tcp_raw"]
+        get_response = copy.deepcopy(RESPONSE_PAYLOAD["tcp_raw"])
+        update_response = copy.deepcopy(REPLACED_RESPONSE_PAYLOAD["tcp_raw"])
         self._plugin._task.args = {
             "state": "replaced",
             "config": [REPLACED_REQUEST_PAYLOAD["tcp_raw"]],
@@ -476,8 +482,8 @@ class TestSplunkEsDataInputsNetworksRules:
         assert result["changed"] is True
 
         # udp
-        get_response = RESPONSE_PAYLOAD["udp"]
-        update_response = REPLACED_RESPONSE_PAYLOAD["udp"]
+        get_response = copy.deepcopy(RESPONSE_PAYLOAD["udp"])
+        update_response = copy.deepcopy(REPLACED_RESPONSE_PAYLOAD["udp"])
         self._plugin._task.args = {
             "state": "replaced",
             "config": [REPLACED_REQUEST_PAYLOAD["udp"]],
@@ -486,8 +492,8 @@ class TestSplunkEsDataInputsNetworksRules:
         assert result["changed"] is True
 
         # splunktcptoken
-        get_response = RESPONSE_PAYLOAD["splunktcptoken"]
-        update_response = REPLACED_RESPONSE_PAYLOAD["splunktcptoken"]
+        get_response = copy.deepcopy(RESPONSE_PAYLOAD["splunktcptoken"])
+        update_response = copy.deepcopy(REPLACED_RESPONSE_PAYLOAD["splunktcptoken"])
         self._plugin._task.args = {
             "state": "replaced",
             "config": [REPLACED_REQUEST_PAYLOAD["splunktcptoken"]],
@@ -497,23 +503,41 @@ class TestSplunkEsDataInputsNetworksRules:
 
     @patch("ansible.module_utils.connection.Connection.__rpc__")
     def test_es_data_inputs_network_replaced_idempotent(
-        self, conn, monkeypatch
+        self,
+        conn,
+        monkeypatch,
     ):
-        self._plugin._connection.socket_path = (
-            tempfile.NamedTemporaryFile().name
-        )
+        self._plugin._connection.socket_path = tempfile.NamedTemporaryFile().name
         self._plugin._connection._shell = MagicMock()
-
         # patch get operation
-        get_response = RESPONSE_PAYLOAD["tcp_cooked"]
 
         def get_by_path(self, path):
             return get_response
 
+        def delete_by_path(
+            self,
+            rest_path,
+            data=None,
+            mock=None,
+            mock_data=None,
+        ):
+            return {}
+
+        def create_update(
+            self,
+            rest_path,
+            data=None,
+            mock=None,
+            mock_data=None,
+        ):
+            return get_response
+
         monkeypatch.setattr(SplunkRequest, "get_by_path", get_by_path)
+        monkeypatch.setattr(SplunkRequest, "delete_by_path", delete_by_path)
+        monkeypatch.setattr(SplunkRequest, "create_update", create_update)
 
         # tcp_cooked
-        get_response = REPLACED_RESPONSE_PAYLOAD["tcp_cooked"]
+        get_response = copy.deepcopy(REPLACED_RESPONSE_PAYLOAD["tcp_cooked"])
         self._plugin._task.args = {
             "state": "replaced",
             "config": [REPLACED_REQUEST_PAYLOAD["tcp_cooked"]],
@@ -522,7 +546,7 @@ class TestSplunkEsDataInputsNetworksRules:
         assert result["changed"] is False
 
         # tcp_raw
-        get_response = REPLACED_RESPONSE_PAYLOAD["tcp_raw"]
+        get_response = copy.deepcopy(REPLACED_RESPONSE_PAYLOAD["tcp_raw"])
         self._plugin._task.args = {
             "state": "replaced",
             "config": [REPLACED_REQUEST_PAYLOAD["tcp_raw"]],
@@ -531,7 +555,7 @@ class TestSplunkEsDataInputsNetworksRules:
         assert result["changed"] is False
 
         # udp
-        get_response = REPLACED_RESPONSE_PAYLOAD["udp"]
+        get_response = copy.deepcopy(REPLACED_RESPONSE_PAYLOAD["udp"])
         self._plugin._task.args = {
             "state": "replaced",
             "config": [REPLACED_REQUEST_PAYLOAD["udp"]],
@@ -540,7 +564,7 @@ class TestSplunkEsDataInputsNetworksRules:
         assert result["changed"] is False
 
         # splunktcptoken
-        get_response = REPLACED_RESPONSE_PAYLOAD["splunktcptoken"]
+        get_response = copy.deepcopy(REPLACED_RESPONSE_PAYLOAD["splunktcptoken"])
         self._plugin._task.args = {
             "state": "replaced",
             "config": [REPLACED_REQUEST_PAYLOAD["splunktcptoken"]],
@@ -550,17 +574,19 @@ class TestSplunkEsDataInputsNetworksRules:
 
     @patch("ansible.module_utils.connection.Connection.__rpc__")
     def test_es_data_inputs_network_deleted(self, conn, monkeypatch):
-        self._plugin._connection.socket_path = (
-            tempfile.NamedTemporaryFile().name
-        )
+        self._plugin._connection.socket_path = tempfile.NamedTemporaryFile().name
         self._plugin._connection._shell = MagicMock()
 
         def delete_by_path(
-            self, rest_path, data=None, mock=None, mock_data=None
+            self,
+            rest_path,
+            data=None,
+            mock=None,
+            mock_data=None,
         ):
             return {}
 
-        get_response = RESPONSE_PAYLOAD["tcp_cooked"]
+        get_response = copy.deepcopy(RESPONSE_PAYLOAD["tcp_cooked"])
 
         def get_by_path(self, path):
             return get_response
@@ -569,7 +595,7 @@ class TestSplunkEsDataInputsNetworksRules:
         monkeypatch.setattr(SplunkRequest, "get_by_path", get_by_path)
 
         # tcp_cooked
-        get_response = RESPONSE_PAYLOAD["tcp_cooked"]
+        get_response = copy.deepcopy(RESPONSE_PAYLOAD["tcp_cooked"])
         self._plugin._task.args = {
             "state": "deleted",
             "config": [REQUEST_PAYLOAD["tcp_cooked"]],
@@ -578,7 +604,7 @@ class TestSplunkEsDataInputsNetworksRules:
         assert result["changed"] is True
 
         # tcp_raw
-        get_response = RESPONSE_PAYLOAD["tcp_raw"]
+        get_response = copy.deepcopy(RESPONSE_PAYLOAD["tcp_raw"])
         self._plugin._task.args = {
             "state": "deleted",
             "config": [REQUEST_PAYLOAD["tcp_raw"]],
@@ -606,11 +632,11 @@ class TestSplunkEsDataInputsNetworksRules:
 
     @patch("ansible.module_utils.connection.Connection.__rpc__")
     def test_es_data_inputs_network_deleted_idempotent(
-        self, conn, monkeypatch
+        self,
+        conn,
+        monkeypatch,
     ):
-        self._plugin._connection.socket_path = (
-            tempfile.NamedTemporaryFile().name
-        )
+        self._plugin._connection.socket_path = tempfile.NamedTemporaryFile().name
         self._plugin._connection._shell = MagicMock()
 
         def get_by_path(self, path):
@@ -652,13 +678,11 @@ class TestSplunkEsDataInputsNetworksRules:
 
     @patch("ansible.module_utils.connection.Connection.__rpc__")
     def test_es_data_inputs_network_gathered(self, conn, monkeypatch):
-        self._plugin._connection.socket_path = (
-            tempfile.NamedTemporaryFile().name
-        )
+        self._plugin._connection.socket_path = tempfile.NamedTemporaryFile().name
         self._plugin._connection._shell = MagicMock()
 
         # patch get operation
-        get_response = RESPONSE_PAYLOAD["tcp_cooked"]
+        get_response = copy.deepcopy(RESPONSE_PAYLOAD["tcp_cooked"])
 
         def get_by_path(self, path):
             return get_response
@@ -666,7 +690,7 @@ class TestSplunkEsDataInputsNetworksRules:
         monkeypatch.setattr(SplunkRequest, "get_by_path", get_by_path)
 
         # tcp_cooked
-        get_response = RESPONSE_PAYLOAD["tcp_cooked"]
+        get_response = copy.deepcopy(RESPONSE_PAYLOAD["tcp_cooked"])
         self._plugin._task.args = {
             "state": "gathered",
             "config": [REQUEST_PAYLOAD["tcp_cooked"]],
@@ -675,7 +699,7 @@ class TestSplunkEsDataInputsNetworksRules:
         assert result["changed"] is False
 
         # tcp_raw
-        get_response = RESPONSE_PAYLOAD["tcp_raw"]
+        get_response = copy.deepcopy(RESPONSE_PAYLOAD["tcp_raw"])
         self._plugin._task.args = {
             "state": "gathered",
             "config": [REQUEST_PAYLOAD["tcp_raw"]],
diff --git a/ansible_collections/splunk/es/tests/unit/plugins/modules/conftest.py b/ansible_collections/splunk/es/tests/unit/plugins/modules/conftest.py
index e19a1e04c..349e71ada 100644
--- a/ansible_collections/splunk/es/tests/unit/plugins/modules/conftest.py
+++ b/ansible_collections/splunk/es/tests/unit/plugins/modules/conftest.py
@@ -2,15 +2,16 @@
 # GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
 from __future__ import absolute_import, division, print_function
 
+
 __metaclass__ = type
 
 import json
 
 import pytest
 
-from ansible.module_utils.six import string_types
 from ansible.module_utils._text import to_bytes
 from ansible.module_utils.common._collections_compat import MutableMapping
+from ansible.module_utils.six import string_types
 
 
 @pytest.fixture
@@ -21,20 +22,13 @@ def patch_ansible_module(request, mocker):
         if "ANSIBLE_MODULE_ARGS" not in request.param:
             request.param = {"ANSIBLE_MODULE_ARGS": request.param}
         if "_ansible_remote_tmp" not in request.param["ANSIBLE_MODULE_ARGS"]:
-            request.param["ANSIBLE_MODULE_ARGS"][
-                "_ansible_remote_tmp"
-            ] = "/tmp"
-        if (
-            "_ansible_keep_remote_files"
-            not in request.param["ANSIBLE_MODULE_ARGS"]
-        ):
-            request.param["ANSIBLE_MODULE_ARGS"][
-                "_ansible_keep_remote_files"
-            ] = False
+            request.param["ANSIBLE_MODULE_ARGS"]["_ansible_remote_tmp"] = "/tmp"
+        if "_ansible_keep_remote_files" not in request.param["ANSIBLE_MODULE_ARGS"]:
+            request.param["ANSIBLE_MODULE_ARGS"]["_ansible_keep_remote_files"] = False
         args = json.dumps(request.param)
     else:
         raise Exception(
-            "Malformed data to the patch_ansible_module pytest fixture"
+            "Malformed data to the patch_ansible_module pytest fixture",
         )
 
     mocker.patch("ansible.module_utils.basic._ANSIBLE_ARGS", to_bytes(args))
diff --git a/ansible_collections/splunk/es/tests/unit/plugins/modules/utils.py b/ansible_collections/splunk/es/tests/unit/plugins/modules/utils.py
index d55afc0b3..923594463 100644
--- a/ansible_collections/splunk/es/tests/unit/plugins/modules/utils.py
+++ b/ansible_collections/splunk/es/tests/unit/plugins/modules/utils.py
@@ -1,13 +1,15 @@
 from __future__ import absolute_import, division, print_function
 
+
 __metaclass__ = type
 import json
 
-from ansible_collections.trendmicro.deepsec.tests.unit.compat import unittest
-from ansible_collections.trendmicro.deepsec.tests.unit.compat.mock import patch
 from ansible.module_utils import basic
 from ansible.module_utils._text import to_bytes
 
+from ansible_collections.splunk.es.tests.unit.compat import unittest
+from ansible_collections.splunk.es.tests.unit.compat.mock import patch
+
 
 def set_module_args(args):
     if "_ansible_remote_tmp" not in args:
@@ -41,7 +43,9 @@ def fail_json(*args, **kwargs):
 class ModuleTestCase(unittest.TestCase):
     def setUp(self):
         self.mock_module = patch.multiple(
-            basic.AnsibleModule, exit_json=exit_json, fail_json=fail_json
+            basic.AnsibleModule,
+            exit_json=exit_json,
+            fail_json=fail_json,
         )
         self.mock_module.start()
         self.mock_sleep = patch("time.sleep")