savedsearch is the search knowledge object for the notable. the correlationsearch.conf stanza goes with that and ES needs it for all the notable like settings. hooks to active responses, title, links for drill down etc.
Okay so to clarify further, I would need both if I were adding my own detections into the ES framework? I didn't see that in the documentation.
Yes, you would need stanzas in both if you were to add your own correlation searches. However, I'd recommend that you use the content management page to create the searches so that the proper attributes are saved in the proper locations. Starting in 4.6.0, only savedsearches.conf references are needed.
Okay, it does appear that when i add a correlation search via the UI (Content Management > Create Content) a savedsearch is created automatically. Doesn't this mean Splunk has to search for the same thing twice to do all the things it needs to do for ES. Perhaps I'm still confused here.
No, the search isn't performed twice, it's just a detail about how the search is stored.