I need to exclude eventID 1058 but only when the host is ServerA or ServerB if its ServerC then I still want to see the event.
I tried NOT (EventID=1058 AND Server=ServerA OR Server=ServerB)
But this is not working as desired.
I tried this with some of my data and this may be a solution for you. The AND, I believe is implied so not needed (notice the parens):
Hope this helps!