A few things going on there. The facet is limited to maybe 2000 items (could be more for some accounts I think). So your sub aggregation will return up to 2000 items. You are then filtering it on your outside. Since your facet isn’t getting you everything its not going to be consistent.
Since you are using filter you do not need the Where in the sub aggregation.
Before using sub aggregation did you simply try to produce a table with the results like this?
SELECT filter(count(*), WHERE step LIKE '%ReturnUrl%') AS 'step9', filter(count(*), WHERE step LIKE 'step10%') AS 'step10' FROM prod_PlansEventLog FACET orderId SINCE 10 day ago LIMIT MAX
Without knowing what you have in your data we have to guess at some some things. I’m going to guess you have more than 2000 orderId’s in the 10 day window. If that’s the case reduce your time window to a period of time when you don’t have 2000 orderid’s. Try that and see if it works.