Splunk Add-on for Microsoft Windows: Issue with calling an object and giving it the same name as the source

[efika]

So I just had an issue that seems to be stemming from the fact that I have used an eventtype with the SAME name as it is in the Windows TA.

Now - if you try to clone an object and give it the same name as the source, Splunk will prompt an error message saying that it "Cannot clone object with name= . Same name as source object."

But- if you try to create from the scratch the EXACT same object with the same name, Splunk will be more forgiving and will let you do that.

So, with reference to this article , calling knowledge objects the same name in different apps is something that is acceptable and has some consistent behavior or is it something that will just lead to problems and should be avoided ?

[micahkemp]

I think this is expected behavior. Splunk will definitely allow you to have knowledge objects with the same name in different apps, and cloning a knowledge object is probably attempting to do so within the same app, which is probably why it prompts you of the issue.

[efika]

Thanks micahkemp for taking the time to reply.
actually you get the error message even if you try to clone the object from one app to another, so for sure there is something that Splunk doesn't allow.