maxresults and stats command

What's the particular command you are running? Yes, the results are accurate over all events for the buckets that are displayed, but only displays up to 10,000 rows.

For example,

* | stats count by id

might only list 10,000 entries, but each count value will be accurate for all events. Furthermore,

* | stats count by id | stats count

will give you the correct number of distinct id's even if it's more than 10,000, and

* | stats count by id | stats sum(count)

will give you the correct total number of events with an id, not just the sum of the first 10,000. (Of course there are other ways to compute these values, but the point is that the limit only affects the total number of final results displayed in the web UI.)

Finally, running

* | stats count by id | outputcsv myoutfile

will write the output file $SPLUNK_HOME/var/run/splunk/myoutfile.csv with the entire set of results, even though only 10,000 are displayed in the web interface.