Since searching is disabled, this would include both ad-hoc and saved searches. Since alerts are based on saved searches, you would not receive any alerts during the period of time in which the number of violations have caused search to be disabled.
You can find some useful searches that you can use to set up an alert on prior to your running into violations, which should help with providing a buffer for you to use for investigation to determine what is causing the violations. For useful searches in determining where the license volume comes from, and how to set up an alert when you get a violation, see the following page:
http://www.splunk.com/wiki/Community:TroubleshootingIndexedDataVolume
... View more