Verify whether the query changes made in this PR addresses the job failure outlined in SWATCH-4429

Since we couldn't reproduce the issue, we need to verify whether or not the changes had an impact.

Acceptance Criteria:

• Verify whether or not the error is visible in logs (splunk/sumo)
• Verify whether or not the Splunk alert is still firing.
• If the changes had no impact and we are still seeing the error, create a card to revisit SWATCH-4429 with any new information gathered.