@yuvaldo  This occurs because there are more than 2580 matching events in the left outer search. For example, this:   sourcetype=access_combined_wcookie source=tutorialdata.zip:* clientip=71.192.86.205 earliest=1617832126 latest=1617832127   returns three events; however, this:   sourcetype=access_combined_wcookie source=tutorialdata.zip:* clientip=71.192.86.205 earliest=1617832126 latest=1617832127 | transaction clientip maxspan=6h   returns 1 event. When you join the results, each event in the left outer search joins with the first matching event in the subsearch, and the total number of events remains the same, with each joined event containing the fields added by the subsearch. ... View more