Identical Detector Names in Splunk Observability Cloud

Applicability

Description

In Splunk Observability Cloud, multiple detectors can appear with the exact same display name. While the display names are identical, the underlying alert conditions and metrics monitored may differ. For example, one detector named XXXXX
monitors ErrorCount while another with the same detector name XXXXX monitors prod-ErrorCount. This behaviour can cause confusion when managing alerts from the detector list page.

Investigation

1. Navigate to the detector list page.
2. Identify detectors with duplicate names.
3. Select each detector and observe the URL in the browser address bar.
4. Confirm that the unique ID string at the end of the URL is different for each detector.

Resolution

Splunk Observability Cloud currently permits identical display names because each detector is assigned a unique internal ID. This is intended functionality. Follow these steps to manage and differentiate detectors:

1. Use the unique ID in the URL to distinguish between detectors with identical names.
2. Rename detectors to follow a standardized naming convention.
3. Adopt a format such as service-signal-environment or team-app-condition.
4. Ensure names are descriptive enough to differentiate between environments (e.g., prod vs. staging).
5. Use grouping or aggregation within a single detector instead of creating multiple similarly named detectors where possible.