How to exclude two event types when together?

[yoshileigh66]

I have noticed that the event_ids that I cannot find documentation for are associated with two eventtypes together. However,  individually, those eventtypes are also associated with other event_ids. 

How do I exclude the two eventtypes from the search only when they are both associated with an event_id? 

I tried eventtype != "xxx" AND eventtype!="yyy" but that doesn't group both of the eventtypes together, if that makes sense. So each event_id associated with "xxx" is excluded from the search, which is not the result I need. 

[woodcock]

This is a basic boolean logic error.  Try this:

... NOT (eventtype="xxx" AND eventtype="yyy")

[ITWhisperer]

Is eventtype a multivalue field in your events? If not, you can make it so (before applying @woodcock 's logic)

| eventstats values(eventtype) as eventtypes by event_id
| where NOT (eventtypes=="xxx" AND eventtypes=="yyy")

Note that the collection of eventtypes are put in a new field so that the original eventtype for the event is preserved