Advanced hunting for Microsoft Purview Data Loss Prevention (DLP) incidents

RS1 
What timeframe are you searching?

A query will only return 10,000 results, and the order will be random each time, so if there are too many log results that match the query, you could get different results each execution.

The query shown as an example will return 48 lines of log will return per user per day for any user that is judged an anomaly, so if you were to search  the last 30 days, you will get 1440 results per user.

a 30 day search could only show a max of 6 users, a 14 day search could show 14 users etc.

Try a shorter timeframe if you can.