Thank you for the previous responses, however I am still not getting
the required results.

Attempted to do the following.

unix:.*\M(WARN|NOTICE)\M(?!.*\Mcore\M.*$).*
AND
unix:.*(WARN|NOTICE).*(?!core).*

The file I am testing on has

1. unix: NOTICE This line has core in it.
2. unix: NOTICE This line does not have the expression.
3. unix: WARN This line has core in it.
4. unix: WARN This line does not have the expression.
5. unix: NOTICE Another line seperate from expression.

I would like to see all lines above where core is NOT in the line.
Which would
match lines 2, 4, 5.

With unix:.*(WARN|NOTICE).*(core) I can get all lines with 'core' in
them.
But attempting to do
unix:.*(WARN|NOTICE).*(!core)  - results in no lines returned.
unix:.*(WARN|NOTICE).*!(core)  - results in no lines returned.
unix:.*(WARN|NOTICE).*(?!core)  - with egrep and awk I get syntax
errors.

The saga continues........

Here is a Tcl expression that I believe does exactly what you want:

\munix\M:.*\m(WARN|NOTICE)\M(?!.*\mcore\M.*)

The \m and \M are used to ensure that the enclosed strings occur as
"words". The last part, the (?!.*core.*) is a negative forward
assertion. It asserts that the string from that point on does not
match ".*\mcore\M.*", that is, that it does not match a string
containing "core" as a word.