Don't use join like that, use stats and OR instead:
earliest=-15d@d latest=now index=wineventlog (EventCode="4624" OR EventCode="4634")
| regex Account_Name!=".*\$"
| eval Day=strftime(_time,"%d/%m/%Y")
| eval User=if(mvcount(Account_Name) > 1, mvindex(Account_Name,1), Account_Name)
| eval login_time = case(EventCode="4624", _time), logoff_time = case(EventCode="4634", _time)
| stats earliest(login_time) as desde, latest(logoff_time) as hasta by User, host, Day
| eval segundos_usados=hasta-desde
...
That will go through both event codes together, and stats-by the two together for each user-host-day triple.
... View more