This is likely due to editing from searches, report and alert.
The 4.6 cloud only release notes mention that starting with this release, the correlationsearches.conf file is no longer used to define correlation searches. Instead, savedsearches.conf uniquely identifies correlation searches using the action.correlationsearch.enabled=1 parameter. The correlationsearches.conf file is deprecated.
The cloud release has some additional steps that will be needed post upgrade so when our next version comes out, I expect similar steps to be called out. If you want to check out the cloud notes about what we are doing there, you can find it here: http://docs.splunk.com/Documentation/ES/4.6.0/User/ConfigureCorrelationSearches#Correlation_searches_migration_to_savedsearches.conf
To resolve your issue now, can you edit the existing correlation search in ES via Configure-Content Management? If it gives you an issue there, your best approach would probably be to grab the content from the saved search and correlation conf files and then re-create it in the Content Management section of ES to ensure things tie together.
... View more