Relevance statement for Splunk

Content Authoring
1

I am banging my head against the wall trying to figure out what is wrong with this relevance statement. I should have approximately 120 servers that it should be returning but I am getting only a few computer names returning. And there is one that is being returned that does not have the relevance in it's DNS name.

What I am trying to attempt is the following:
If the computer name has horne.com in it's dns name but it cannot contain any computer names with the following in its name, wsphrnsiem. My relevance is below, but obviously something is not correct with it. It seems pretty straight forward. Any help will be appreciated.

(computer name as lowercase contains "horne.com") and (not (computer name as lowercase contains "wsphrnsiem"))

2

The one shared failed to parse

Try with below

exists dns names whose (it as lowercase contains "horne.com" and it as lowercase does not contain "wsphrnsiem")

Or

exists computer names whose (it as lowercase contains "horne.com" and it as lowercase does not contain "wsphrnsiem")