The transaction is a relatively expensive operator in the Splunk pipeline. I would spend more time trying to refine your base search if you can. Meaning: if you have a specific sourcetype (it looks like you're searching across WinEvent::Security logs) refine your search with that sourcetype as opposed to search across all of your data in your index.
So, your search might look something like this:
sourcetype="WinEvent::Security" EventCode="0" OR EventCode="4624" earliest=-30m | transaction ComputerName startswith=(EventCode="4624") endswith=(EventCode="0") maxevents=2 | eval duration=round(duration,1) | search duration<30 AND duration>2| stats stdev(duration) as StdDevDuration avg(duration) as AvgDuration count(ComputerName) as count_value | table AvgDuration, StdDevDuration, count_value
... View more