remove URL from search result is not working

[jw44250]

My Splunk Query

index= index1 sourceType=source1 "Error" OR requestURl != "/test/abc" OR requestURI != "/person" OR requestURI != "error.php"

but still im getting the requestURI in my search result.

Im intersted in those events that have error .

[woodcock]

LIke this:

index="index1" sourceType="source1" Error AND NOT (requestURl="/test/abc" OR requestURI="/person" OR requestURI="error.php")

[jw44250]

Thank you

[richgalloway · Accepted solution]

Every error message will match your query because they will all pass at least one of the requestURI tests. Try this query instead. It will display all errors except those from "/test/abc", "/person", and "error.php".

index= index1 sourceType=source1 "Error" (requestURl != "/test/abc" AND requestURI != "/person" AND requestURI != "*error.php")

[jw44250]

Thank you