I need to exclude eventID 1058 but only when the host is ServerA or ServerB

[Tellon]

I need to exclude eventID 1058 but only when the host is ServerA or ServerB if its ServerC then I still want to see the event.

I tried NOT (EventID=1058 AND Server=ServerA OR Server=ServerB)

But this is not working as desired.

[Jeff_Lightly_Sp]

I tried this with some of my data and this may be a solution for you. The AND, I believe is implied so not needed (notice the parens):

• sourcetype= NOT EventID=1058 AND (Server=ServerA OR Server=ServerB)

Hope this helps!