Having a problem with HAVING

with dcnt as(
  select deviceeventclassid, devicehostname, name, count(*) as dev_count
   from  events
  where  devicevendor  =  'Bilbo'
   and   name not like '%config%'
  group by deviceeventclassid, devicehostname, name )
select d.deviceeventclassid as "Event ID", e.deviceaddress as "Device Address", d.name as "Event Name",
       d.devicehostname as "Device Host Name", d.dev_count as "Count"
 from  dcnt d join events e on d.deviceeventclassid  =  e.deviceeventclassid
                           and d.devicehostname      =  e.devicehostname
                           and d.name                =  e.name
where  d.name not like 'Port%'
  or   ( d.name like 'Port%'
 and     d.dev_count  <  11 )
order by d.devicehostname

select deviceEventClassId "Event ID", deviceAddress "Device Address", name "Event Name", deviceHostName "Device Host Name",
       count( concat(deviceEventClassId, deviceHostName, name)) "Count"
 from  events
where  deviceVendor  =  'Bilbo'
 and   name not like '%config%'
group by deviceHostName, deviceEventClassId, name
having name not like 'Port%'
  or   ( name like 'Port%'
 and     count( concat( deviceEventClassId, deviceHostName, name ) ) > 11 )
order by deviceHostName