Urchin hasn't been updated since 2012.
If you're ready to replace Urchin,
Check out Angelfish Software

Urchin Support Plans

Configuring Urchin 6 Filters

To create a new filter, first navigate to the filter list by clicking Configuration in the top-right part of the screen. Next, on the left menu, choose Urchin Profiles >> Filter Manager. On this screen, you'll see an add button. After clicking on that button, Urchin will prompt you with a filter setup wizard.

Complete the Filter Form:

The wizard screen is shown to the right. Complete the form:

  1. If using datacenter mode, select the appropriate account for this filter. Select "(NONE)" to use the default account.
  2. Enter a name for the new filter (try to make this descriptive as filters can be difficult to differentiate).
  3. Choose the Filter Type and complete the respective fields for the selected type. (see below)
  4. Click Finish to create the filter.

At this point, the filter will exist, but will not be applied to any profiles. See the section below (Applying Filters to Profiles) for instructions on how to do this.

Filter Types
Urchin 6 allows for 5 types of filters. Each allow for regular expressions. Descriptions of each filter type are as follows:

Exclude all traffic that matches the given expression. Include everything else.
Include all traffic that matches the given expression. Exclude everything else.
Search and Replace
Search the specified field for a string and replace each occurrence of that string with the given value.
Lookup Table
If a lookup table exists, lookup the given field and replace fields with the necessary parameters.
Allows for up to two fields to be matched, and, if they do, overwrites or appends to another field. If regular expression grouping is used for Field A or Field B, those groups may be extracted by using $[Field][Group #] (For example, $B2 would take the second grouping from field B).

Filter Execution Order
Filters are executed by type, in the following order: Advanced, Search & Replace, Lookup, Exclude and Include. Within each type, filters are executed by ID in their respective tables in the database. So, if you'd like multiple filters of the same type to execute in a particular order, it is best to create them in the order in which they are to be executed.

Applying Filters to Profiles
There are two ways to apply filters to profiles. To apply a list of filters to one profile, do so under the Filters tab within a profile's settings. To apply a single filter to multiple profiles, do so under the Profiles tab within a filter's settings. Whichever method is being used, select the appropriate items from the left list (hold shift or ctrl to select multiple items) and click the right arrow to move them to the right list. Alternately, you may remove items from the right list in the same fashion. Once all changes are made, click Update to apply them.