I am trying to figure out how to exclude a specific pattern in a CEM definition. Reason is that I want to exclude automated monitor transactions from the reporting. I have two ways to identify the monitor:
1) using the NTLM Authentication field, I could exclude the particular userid the monitor uses.
2) using the HTTP Request "User-Agent" field, I could also exclude the pattern associated with the monitor.
I tried all sorts of ways to specify a "negate" regex. According to documentation, PCRE regex shoudl be supported. I tried putting in the PCRE negate expression (?!(xxxxxxx)) to no avail. CEM does not filter out the transactions.
To be sure what I was doing was right, I tried the same type of negate pattern in a CLW command listing agents: list agents matching (?!(Custom))(.*) gives me the correct results i.e. all the agents with names not starting with "Custom".
Has anyone ever successfully defined a CEM transaction that "excludes" a particular pattern ?