Queries that do not include aggregate functions are automatically limited to returning only 200 rows in order to limit output. This is achieved by automatically adding the query function tail() to each query:

| tail(200)

For example, a simple filter query like the following example might look like the following before adding tail():

username = "abenson"

When executed, tail() is added, changing the query to look like this:

username = "abenson"
| tail(200)

However, if the query includes an aggregation function, no limit is implied, and is executed without the implied limit:

username = "abenson"
| groupBy(processname)