I don't know if you found the solution, but it may have to do with needing the Repeating Block surrounding (or inside -- haven't tested that) the Source Events Block.
Correlated Event Time: [$First Time] through [$Last Time]
Source IP Address: [$Source IP]
I don't know for certain that's what's needed, but that's how my alert is configured and it shows 5, 10, or even 60 events (even though the documentation says it'll only show 10). I was also on 9.4.2 and now 9.5.0 if you're using a different version of SIEM.