Here is my search:
index=database action_id="CR" OR action_id="AL" database_name= "test" NOT (server_principal_name = account_1 OR server_prinicipal_name = account_2 OR server_prinicipal_name = account_3)
Search result still showing event including server_prinicipal_name=account_1 server_principal_name=account_2 and account_3