index=database action_id="CR" OR action_id="AL" database_name= "test" NOT (server_principal_name = account_1 OR server_prinicipal_name = account_2 OR server_prinicipal_name = account_3)
Search result still showing event including server_prinicipal_name=account_1 server_principal_name=account_2 and account_3
Make sure the field name and values are spelled correctly. The field name in the example search has different spellings. Have you tried putting quotation marks around the values?
--- If this reply helps you, Karma would be appreciated.
