Subsearch 2 fields with Match and 1 mismatch

index =ttt beforeController [search index = ttt beforeController | fields pnr, bnr, NOT(gnr)] How can I achieve that? I am trying to subsearch same types of transactions where 2 fields needs to match exactly(pnr, bnr) but 3 one should not match(gnr). I was able to achieve 2 match but couldnt do 3rd match with the following: index=ttt beforeController [search index= ttt beforeController | fields pnr, bnr]