title: How to ignore a specific sub-string from Splunk query
body: <p>Need some help to generate appropriate Spunk query. I am searching for this but could not come up with a solution.</p>
  
  <p>Currently, I want to ignore all error alerts that are generated for logs with only ev31=<em>error</em>; term. If we use NOT ev31=<em>error</em>; in search query, it also removes results with valid error terms. So the current query will fail in case log contains both error and ev31=<em>error</em>; terms resulting in incorrect results. </p>
  
  <p>Can anyone suggest a example query, where we can ignore ev31=<em>error</em>; term altogether but keep logs with error term.</p>