This isn't really an answer, but possibly an explanation that could help.
After you search for your job under Build Analysis, click "Open in Search" to view the search used. Remove the "Slave='*'" option from the search and tell me what status is returned.
I'm having a similar problem. I'm finding the event_tag for my "job event" doesn't include a node (or in your case a slave) so Splunk filters out the incoming "completed" job event since it doesn't have a node associated with it. After removing the need for a node to be included, it picks up the "completed" event and marks the build as a completed as it should.
I'm still not sure why this is, but I'm curious if others are having similar issues. Your issue may be similar in nature where the event_tags being sent aren't including a required property that Splunk expects to see because it isn't included in the "completed" event sent to Splunk.
... View more