The alerts may not work correctly because the alert query does not consider events that exist in the disk blocks and are not indexed/stored yet. As a result, the alert condition hit/non-hit can be deceptive, because it is not based on all events for the specific time range.
Example: An alert is created based on some filter and the condition is "In the last 5 minutes, the number of matches found is less than 1."
If the events corresponding to the alert filter are in disk blocks when the alert query is run, then the query result will be 0, and false alert will be sent. Later, the events will be handled and stored and it will be obvious that there are results in that period of time and the alert should not be sent.