Hi @Splunkanator,
If your events have an extracted uri_query field, which is typical for e.g. NCSA and W3C log formats, you can use != or NOT to exclude events:
index=main sourcetype=access_common uri_query!=*param=X* uri_query!=*param=Y* uri_query!=*param=Z*
or
index=main sourcetype=access_common NOT uri_query IN (*param=X* *param=Y* *param=Z*)
However, those will exclude events with partially matching names or values.
Performance will vary, but you can use the regex command to match events with fields that do no match a regular expression:
index=main sourcetype=access_common
| regex uri_query!="(^|&)param=(X|Y|Z)(&|$)"