Webtrends Analytics 9 Adminstration Guide, November 2012
When you create a filter, you specify whether to include or exclude the filtered information.
Include filters specify that analysis includes only the information specified in the filter. For example, if you analyze a profile using an Include filter that specifies domains in the UK, reports based on the profile include only data from domains that include the string *.UK. Exclude filters specify that analysis includes all data except the information specified in the filter. For example, if you analyze a profile using an Exclude filter that specifies domains in the UK, reports based on the profile include all the data in the web activity data file except data logged for domains that include the string *.UK.
You can use multiple filters of the same type (include or exclude) or combine different types in the same custom report or profile. For example, if you want to determine how much of your domestic web server activity comes from organizations other than the military, you can create an include filter for all U.S. user addresses and an exclude filter for all military user addresses. Webtrends processes the include filters first and then the exclude filters. For any given activity, if both an include filter and an exclude filter match data in the web activity data file, the exclude filter prevails and the data is excluded.
When you use multiple filters of the same type (multiple include filters or multiple exclude filters), if the information meets the criteria of any of the filters, it is included. For example, if you combine an include filter definition of URL= est.htm with an include filter definition of returncode=304, Webtrends includes all hits that have either a URL of est.htm OR a return code of 304. The order in which you specify filters does not affect the way they are processed.
The following graphic shows how Webtrends applies include and exclude filters. The web data files in the left column pass through an include filter and then an exclude filter. The final data set for analysis is shown in the right-hand column.