There is a known limitation about live queries that use join() functions — the details are explained at Limitations of Live Joins. The limitation means that alerts cannot be expected to work in combination with these particular query functions.

You should be aware of this when you intend to create an alert with join() functions, as the alert may not trigger as expected.

The UI warns you about this behaviour before you save the alert:

Figure 183. Warning Using Live join()

In such cases, creating a scheduled search instead would better achieve the expected result.