it's not a problem to have the first logon (EventCode=4624) but the problem is that in Windows a logon action generates many (more than 10) logon events (4624, 4672, 4634, ...) and it's difficoult to find the real logoff because there isn't a transaction code to connect events.
You could use username, but if you have more logons of the same user on the same host in the same day you cannot distinguish them.
Anyway, you could run something like this in the time period you need:
index=wineventlog sourcetype=WinEventLog:Security (EventCode=4624 OR EventCode=4634)
| eval day=strftime(_time,"%d/%m/%Y")
| stats earliest(_time) AS earliest latest(_time) AS latest by user host day
| eval earliest=strftime(earliest,"%d/%m/%Y %H.%M.%S"), latest=strftime(latest,"%d/%m/%Y %H.%M.%S")