Splunk has transaction
command which can produce duration
between logs grouped by id:
2020-01-01 12:12 event=START id=1
2020-01-01 12:13 event=STOP id=1
as it is described on
How to calculate duration between events in Datadog?
You can use group queries to create transactions that will automatically calculate the duration. This screenshot is an example of logs grouped into transactions by CartId
.