Splunk has transaction command which can produce duration between logs grouped by id:
2020-01-01 12:12 event=START id=1
2020-01-01 12:13 event=STOP id=1
as it is described on
- Query for calculating duration between two different logs in Splunk
- Splunk - duration between two different messages by guid
- transaction time between events
How to calculate duration between events in Datadog?
