There are a few reasons why tracking session logon time in this manner is not accurate. For one, users typically don't physically log out, they lock their workstation, or allow the screen saver to lock it (which doesn't actually lock the workstation until someone wakes the computer back up). Also, someone trying to evade time detection can just hit the power button on the machine, assuming they have physical access to the box. That being said, the following search should get you started in the right direction: source="WinEventLog:Security" EventCode=4624 OR EventCode=4634 Account_Name=* action=success | eval User=if(mvcount(Account_Name)>1, mvindex(Account_Name,1), mvindex(Account_Name, 0)) |eval User=lower(User)| search NOT User=*$ | transaction User maxevents=2 startswith="EventCode=4624" endswith="EventCode=4634" maxspan=-1 |stats sum(duration) As Duration by User, ComputerName |eval Duration(M)=round((Duration/60), 0) |table User,Duration(M),ComputerName ... View more