When you click on an alert in order to see all instances of that alert, the web client makes the following request:
Here it's asking for all alert instances for definition 9 OR all alerts in the system that are CRITICAL/WARNING.
I clicked on the alert for definition 9, and I only expect to see alerts for that definition. The 2nd part of the query (the OR) gets all alert instances. In a large cluster, this is a performance problem.