limit for values of field 'message' reached. Some values may have been truncated or ignored. What it means?

[VS0909]

I got below warning:

"'anomalydetection' command: limit for values of field 'message' reached. Some values may have been truncated or ignored."

1) Does this means that some events are removed. For eg, if there are 2000 events , then less than 2000 events are considered (like 1500) ?

1) Does it means all events are considered, but length of the event is truncated. For eg, if there are 2000 events, it will consider all 2000 events, "message" value will be truncated like "message"="ABC" then truncated value  "message"="AB"? 

[thambisetty]

Anomolydetection uses anomolousvalue and outlier command capability.

https://docs.splunk.com/Documentation/Splunk/8.0.6/SearchReference/Anomalydetection

check Limits for anomalousvalue in  limits.conf to find answer for your questions.

https://docs.splunk.com/Documentation/Splunk/8.0.6/SearchReference/Foreach