Because once you pipe, you cannot search for generic text the way you can in the initial search
If you do this instead, it will work:
index=_internal NOT ("error" or "warn") May 21, 2020 at 10:20AM
via reddit https://www.reddit.com/r/Splunk/comments/gnxjjv/why_does_these_not_filters_do_not_work/frcew01?utm_source=ifttt