If you define multiple output groups, events are pushed to all of them at the same time (unless you override the routing per input or in transform). If you have multiple destination hosts in an output group, they are handled in a round robin way. There's no other way using built-in mechanics. You'd need to either use http output and install and intermediate http rev-proxy with health-checked and prioritized backends or do some form of external "switching" of the destination based either on some dynamic network-level redirects or DNS-based mechanisms. But all those are generally non-splunk solutions and add complexity to your deployment. ... View more