How frequently are the events logged and do is active vs inactive determined? Assuming the events logged are only when the user is active, you can try something like this
... | stats earliest(_time) as start latest(_time) as end by USER_ID | eval duration=tostring(round(end-start, 0), "duration")
If events are logged for active as well as inactive state, try this
... state="active" | stats earliest(_time) as start latest(_time) as end by USER_ID | eval duration=tostring(round(end-start, 0), "duration")**
... View more