We have created a BT that captures the URLs taken more than 10sec from particular agent groups. Now we want to exclude a particular type of URLs so we have kept condition in "contains not" . But the BT is still capturing the URLs that are really needed to be excluded. Can you please tell why this is happening?
I can't tell you why this is the case with certainty but I've found it's better to create a filter that does match the url/pattern you are interested in and use a lower severe threshold of zero to exclude thing as opposed to try to use any of the "not" pattern options.
It might be because using contains not means they will match everything except that but will still match the unwanted pattern with the main filter measure you used. So it doesn't get explicitly excluded by using contains not, it just isn't matched in that filter. Using contains/matches/regex for the pattern with a lower severe threshold of zero means the purepath will only be included if it does not contain that url (has zero occurrences of it).
I have changed the occurrences on purepath from 'all' to 'entry point' and now it is working fine. Can you tell me the difference between all and entry point. Ideally all also should work in excuding the contains not URL.
All would look at everything applicable in the PurePath, so for instance with web requests it would look at every web request including internal. Entry point means it will only apply when it is applicable to the entry point of the PurePath (i.e. the first thing that appears in the tree).
Not sure why you would be seeing different behavior just from that change.