For HTTP decode:
Does the number of OA counted refer to the number of times the string has been matched in every HIT or every OPERATION? Considering every operation has the potential to be made from multiple hits. Also, if the string exists twice in the same hit, is it counted twice or once?
I'm on 11.5 for this instance, if that makes any difference?