my $REPORT_INTERVAL = 300; # seconds
  my %active = ( 'split' => 0, 'filter' => 0);
  my $next_report = date_to_timestamp("...start of day...");
  my $last_report = date_to_timestamp("...end of day...");
  while(<>) {
    # Parse out the fields
    my ($date, $action, $jobtype, $logfile) = /.../;

    # Update current active job counts
    if ($action eq 'start') {
      ++$active{$jobtype};
    elsif ($action eq 'finish') {
      --$active{$jobtype};
    } else {
      die "Huh? $_";
    }

    # Output counts for all report lines between
    # the last printed report and the time of this
    # log line. Most of the time, this will be empty
    # because we won't have reached the next report
    # time yet.
    my $stamp = date_to_timestamp($date);
    while ($stamp > $next_report) {
      report_counts($next_report, \%active);
      $next_report += $REPORT_INTERVAL;
    }
  }

  # Finish off the report for the report periods
  # at the end of the reporting range.
  while ($next_report < $last_report) {
    report_counts($next_report, \%active);
    $next_report += $REPORT_INTERVAL;
  }
[download]

Based on your proposed solution, it seems like you think that you have to correlate a finish event with the start event for that job -- but if all you want is the counts, then as gaal said, the correlation is unnecessary.

If for some reason you do need to correlate them, then you can always keep all active jobs' state in the %active hash:

  ...
  if ($action eq 'start') {
    $active{$jobtype}{$logfile} = 1;
  } elsif ($action eq 'finish') {
    delete $active{$jobtype}{$logfile};
  }
  ...
  my $split_count = keys %{ $active{'split'} };
  ...
[download]