https://community.splunk.com/t5/Getting-Data-In/add-blacklist-to-previous-deploy-app/m-p/550671#M91434 <P>I am using the standard 'Splunk_TA_nix' deploy-app on all of my Linux agents. Now, we are starting to deploy Cortex XDR and the local /var/log/traps/traps.pmd log is extremely verbose and unnecessary to collect in Splunk; it's already being collected by the Cortex XDR console.</P><P>How do I blacklist that one log-file without editing the original deploy-app?</P><P>I have tried creating an additional deploy-app which specifies that folder, then blacklists that file, but it doesn't work. Maybe I have a typo (see below) but my suspicion is that there's a precedence issue, i.e., I can't modify the input stanza from the first deploy-app?</P><P>MY NEW DEPLOY-APP's INPUT.CONF</P><P>&nbsp;</P><LI-CODE lang="markup">[monitor:///var/log/traps/] blacklist = traps.pmd recursive=false disabled = false index = os sourcetype = syslog</LI-CODE><P>&nbsp;</P><P>&nbsp;</P> Thu, 06 May 2021 17:19:26 GMT ttovarzoll 2021-05-06T17:19:26Z https://community.splunk.com/t5/Getting-Data-In/add-blacklist-to-previous-deploy-app/m-p/550671#M91434 <P>I am using the standard 'Splunk_TA_nix' deploy-app on all of my Linux agents. Now, we are starting to deploy Cortex XDR and the local /var/log/traps/traps.pmd log is extremely verbose and unnecessary to collect in Splunk; it's already being collected by the Cortex XDR console.</P><P>How do I blacklist that one log-file without editing the original deploy-app?</P><P>I have tried creating an additional deploy-app which specifies that folder, then blacklists that file, but it doesn't work. Maybe I have a typo (see below) but my suspicion is that there's a precedence issue, i.e., I can't modify the input stanza from the first deploy-app?</P><P>MY NEW DEPLOY-APP's INPUT.CONF</P><P>&nbsp;</P><LI-CODE lang="markup">[monitor:///var/log/traps/] blacklist = traps.pmd recursive=false disabled = false index = os sourcetype = syslog</LI-CODE><P>&nbsp;</P><P>&nbsp;</P> Thu, 06 May 2021 17:19:26 GMT https://community.splunk.com/t5/Getting-Data-In/add-blacklist-to-previous-deploy-app/m-p/550671#M91434 ttovarzoll 2021-05-06T17:19:26Z