hi @rodrigobortolon You are correct, I suggest running the 2 joins separately first and validating that we get all events from the first index(including common events in both indexes) for the left join and then validating that we only receive A intersection B events from the inner join If this works, can you then run the whole query as it is and confirm how the result looks like? It might be worthwhile to rename as follows: left join - same as it is inner join - rename first rrid from main query as something else, rrd_1 and also use the same field rename in inner join PS- Do you have access to _audit and _internal indexes? I am struggling a bit to better visualize the requirement, and we can kind of perhaps mock this scenario using those 2 indexes ... View more