Splunk App for CEF: Configuring two outputs in an output group, does this send all data via syslog to both endpoints, or does it load balance between the two?

[joshclarkA]

Configuring two outputs in an output group, does this send all data via syslog to both endpoints or does it load balance between the two?

[jcoates_splunk]

good question -- I think the default is to load balance because it's setting the defaultGroup value, but you've got a lot of options if you're willing to edit the file. http://docs.splunk.com/Documentation/Splunk/6.3.0/Forwarding/Configureforwarderswithoutputs.confd