When LogScale returns results the results must have been aggregated through am Aggregate Function for it to be displayed. This is to reduce the number of events that are returned in the final result set.

If an aggregation is not included in the submitted query, then LogScale adds the aggregation tail(200) to limit the default result set to 200 events.

This limit on the results applies both to the main query and subqueries. To get a larger a larger result set without an aggregate, manualy add a larger value to tail() to increase the number of results.

The maximum number of results that can be returned is set by the StateRowLimit. To automatically use this maximum value, use tail(max).