removing more than one field value conditionally

[TaraAshley]

I am working on a query that lists hosts and their corresponding instances. My results look like the example below. 

I want to only remove the 111222 host when the instance is R: from my results. I am not certain on how to do this within my query. 

Host	Instance
111222	A:
111222	C:
111222	R:
333444	A:
333444	C:
333444	R:

[yuanliu]

"111222 host when the instance is R:" is ambiguous.  You should include an illustration of desired results in a question.

1. The most literal interpretation is to only remove the row with host 111222 AND Instance R:.  In other words, you want

Instance	host
A:	111222
C:	111222
A:	333444
C:	333444
R:	333444

For this, you can do 

| where NOT ( host == "111222" AND Instance == "R:")

BTW I don't think you should rename host to Host until everything is done.

2. But your context makes me suspect that you actually mean to remove host 111222 IF Instance R: runs on it and no matter what other instances are there.  In other words, you want

Instance	R_or_not_R	host
A:	A: C: R:	333444
C:	A: C: R:	333444
R:	A: C: R:	333444

For this, you need

| eventstats values(Instance) as R_or_not_R by host
| where host != "111222" OR R_or_not_R != "R:"​

Which one is it?

Here is an emulation

| makeresults format=csv data="host,	Instance
111222,	A:
111222,	C:
111222,	R:
333444,	A:
333444,	C:
333444,	R:"
``` data emulation above ```