The default is 500, does it mean only 500 records we can see?
There's very little information here to allow us to help.
Can you show screenshots of the query you are running in the viz and the output?
It means of the 500 records it has found, 500 of them contain this value.
You can configure kibana to change the number of documents that are used in the discover app. docs
Viewing Document Data
When you submit a search query, the 500 most recent documents that match the query are listed in the Documents table. You can configure the number of documents shown in the table by setting the discover:sampleSize property in Advanced Settings.
I would be careful setting this value too high. 500 was chosen because it is a decent balance between data and speed, and should give you a descent starting point to explore your data and look for anomalies.