Hi, I've experienced both of cases. In a lab, I observed an UF totaly stopping data forwarding through any output as soon as one of them gone down. On the other side,under production , I also seen some UF to continue to work without any problem with a faulty configured ouput group; and no custom settings. I thinks that a difference is made by output type. e.g. if the two groups are tcpout, so the events are considered cloned. If one of the group is a tcpout, and the other one a syslog (the case of my past lab), the events are not considered as cloned. Just an intuition that should be verified under a Lab, but that's the better I have for now. @splunk : a little definition of "cloned" event could be very usefull here.
... View more
