Hi Stéphane,
Your questions make sense. If you change the search that defines conditions for an alert, then the triggering no longer works in the same way. It's essentially a new search, which requires a new alerting configuration.
My suggestion would be that when you change a search but want the same alert triggering to happen, that you check the configurations carefully in savedsearches.conf or in Splunk Web, from the home page, at Settings > Searches, Reports, and Alerts.
I don't have more information about internal mechanisms for alerting, but I can say that configurations you make for alerts, such as conditions and suppression, are saved to the .conf files. You can adjust settings in Splunk Web or in the savedsearches.conf file and should be able to make sure you have the search conditions and the alert settings you want.
Hope this helps!
Best,
@frobinson_splunk
... View more