This will work:
NOT message.request.authorization=*
See also http://answers.splunk.com/answers/6981/which-is-better-not-or
This will work:
NOT message.request.authorization=*
See also http://answers.splunk.com/answers/6981/which-is-better-not-or