Splunk acceleration never completes because it hits a search time limit. In my case I determined that it was set to 600 seconds or 10 minutes. I have been fighting this recently. How did I come to this conclusion? I had a search which collects millions of records and must add up and convert the amounts based on a currency lookup table. I wanted to accelerate this search over a 1 month period. The acceleration got stuck at 44%. By default splunk has the acceleration schedule set to happen every 10 minutes. You can change it by adding this in the savedSearch.conf:
auto_summarize.cron_schedule = 3,13,23,33,43,53 * * * *
In this particular example, I was shifting the schedule so that it does not happen at the 0, 10, 20,30,40,50 minutes because too many accelerations triggered huge load spikes.
Anyway, I changed the schedule so that the acceleration process happens only once an hour. Then I watched it. At the specified time the updating message appeared, and exactly 10 minutes later, on the dot, it showed 44%. Then next message was "pending" which is what happens when the acceleration process has nothing to do. And the same thing happened again at the scheduled time.
So, my recommendation is: if you can, use a smaller time range, or use a different technique, such as building a dataset in the summary index with a query that runs every 5 minutes, and then use your regular search to get the data to show.
... View more