Joins don't always behave as expected. You are joining on the "Login" field which means the first occurrence of Login will be pulled into your main search. If Login in your subsearch exists multiple times with different usernames for each one, this poses a problem as now those logs will not be pulling in.
A better way is to avoid joins. They typically lead to unexpected behavior and poor search performance. Alternatively, stats can be used.
I haven't tested this, as I don't have your data. But try this out:
index=ecto_edpgs_grrs ((sourcetype=ecto_application "Successfully logged in" Login!="ALL") OR (sourcetype=ecto_person WKR_EMP_STA_CD !="T"))
| rename WKR_STD_ID as Login, WKR_FLL_NM as UserName
| eval left_join_filter=if(sourcetype=="ecto_application",1,0)
| stats values(UserName) as UserName, values(WKR_EMP_STA_CD) as WKR_EMP_STA_CD, values(_time) as _time, sum(left_join_filter) as left_join_filter by Login
| where left_join_filter>0
| fields - left_join_filter
In short, this pulls your sub-search into the base search. Then, after keeping your renamed fields, applies a filter to mimic a left-join. Since all a left join is doing is appending to the base search where there is a match on Login. Then with stats we group by Login and afterwards filter to keep only the events from the base search that match Login.
