what happens if two outputs.conf files were sent to a host using the splunkforwarder ?

[nawazns5038]

A host was already sending data using an outputs.conf file . Another outputs.conf was added with out knowing which is linked to some other indexers. So what happens here ? Will it send the same to both groups or use the latest one or only the old one ?

[jwelch_splunk]

This document addresses your question in detail.

https://docs.splunk.com/Documentation/Splunk/6.5.1/Admin/Wheretofindtheconfigurationfiles

[pradeepkumarg]

AFAIK it will consider the outputs from an app that comes first in the alphabetical order.

For eg:

abc_outputs
xyz_outputs

abc_outputs will take precendence