Email user if windows session is X days old

[splunky_monkey]

I am trying to set up an alert in Splunk that will email a user whenever their Windows session is X days old. It would be across multiple hosts/users and use the security event log to determine if there hasn't been a 4647 or 1074 event since their 4624 logon event. 

Has anyone set up something similar?

Thanks in advance!