Check your savedsearches.conf file and see if you have other saved searches named the same as your alert you're trying but perhaps with different spacing. Also try just naming the alert differently.
I'm getting same error although no duplicate name exists.
Try running the
btool command line utility to see if there are any configuration errors.
$SPLUNK_ROOT/bin/splunk btool check
I dont get any output for that command.
sh-4.1$ ./splunk btool check
How are you "saving the search"? Via UI or API?
I'm saving via UI.
Did you get to figure the root cause for this?
No, not yet. What version of Splunk and which options are you choosing when you save? I want to replicate the problem on my end.
We are using 6.3.7 and I was trying to save it as a report.
Can you share the search as well?