I would consider doing this
index=xyz procedure=* ("Started processing" OR "Finished processing")
| transaction procedure startswith="Started processing" endswith="Finished processing" keepevicted=f
| timechart avg(duration) as AvgDuration by procedure span=1h
assuming that "procedure" is the name of the field that contains the names of the stored procedures (sproc1, etc.).
However, if your dataset is very large, the transaction command will consume a lot of memory and may not work well.
... View more