Explanation
A correlation search that is set to run in real-time mode will be executed as new events are indexed. Real-time mode means that the search continuously runs over a rolling window of time, such as the last 15 minutes or the last hour. Real-time searches can detect patterns and anomalies in near real-time and trigger adaptive response actions accordingly. However, real-time searches are more resource-intensive than scheduled searches and may impact the overall performance of the system. Therefore, Splunk Enterprise Security uses indexed real-time searches by default for some correlation searches, which are more efficient than non-indexed real-time searches. You can change the search mode of a correlation search from real-time to scheduled or vice versa from the Content Management page. See Configure correlation searches in Splunk Enterprise Security1 for more details. The other options, A, C, and D, are not correct. Always-On is not a valid search mode for correlation searches. Scheduled mode means that the search runs at a specified interval, such as every 5 minutes or every hour. Continuous mode is a deprecated search mode that is no longer supported by Splunk Enterprise Security. References = Configure correlation searches in Splunk Enterprise Security

Reference:
https://docs.splunk.com/Documentation/AddonBuilder/3.0.1/UserGuide/Overview

Explanation/Reference: https://docs.splunk.com/Documentation/ES/6.1.0/User/EndpointProtectionDomaindashboards

Explanation/Reference: https://answers.splunk.com/answers/565482/how-to-resolve-skipped-scheduled-searches.html