I can confirm that I have the same behavior on a brand new install (with Windows App) running on a Windows 2008 R2 64bits as local system account. It indexes everything twice but I'm not sure they are exactly the same as you can see on my screenshot :
Splunk Screenshot
You can see that one host is indexed as DC02 and the one is indexed with the domain name. You can also see that the Application logs matches at 3944 events, the System logs matches at 3210 but the Security log from WinEventLog has 20 more events than WMI:WinEventLog at the exact same update time.
I have also noticed that the difference between WinEventLog and WMI:WinEventLog is even bigger if you run Splunk as "Domain Administrator"
Finally in Windows App, when you try to run any search query related to Event logs, it only searches for events from WinEventLog and not from WMI:WinEventLog thus you will only get results for the localhost unless you edit the queries.
That is what I have experienced so far.
Follow up :
After further testing, It appears to me that Windows App forces local Event logging which logs informations as WinEventLog. When you enable remote log collection, it uses WMI:WinEventLog. I won't be using Windows App on my deployment so I will be turning off local logging and using WMI only as they finally seem to be collecting the same information.
... View more