How to calculate how long a user has been logged on for on windows VM?

[Person]

Hello,

I'm wondering how I can calculate the time difference of these two items that I made to tell me how long a user has been logged in for.

Here are the items I made that tell me when there has been a logon or a sign out.

name: User signed in
Type: Zabbix agent (active)
Key: eventlog[Microsoft-Windows-TerminalServices-LocalSessionManager/Operational,,,,25,,]
Type of information: Log
Update interval: 1m

name: User Sign out
Type: Zabbix agent (active)
Key: eventlog[Microsoft-Windows-TerminalServices-LocalSessionManager/Operational,,,,23,,]
Type of information: Log
Update interval: 1m

I have tried making my own calculated item but it does not seem to be working.

name: Amount of Time spent signed in
Type: Calculated
Key: user.session.duration
Type of information: Log
Formula: last("User Sign out") - last("User sign in first time")
Update interval: 1m

[irontmp]

Hello,

I'm wondering how I can calculate the time difference of these two items that I made to tell me how long a user has been logged in for.

Here are the items, like philosophical questions on love I made that tell me when there has been a logon or a sign out.

name: User signed in
Type: Zabbix agent (active)
Key: eventlog[Microsoft-Windows-TerminalServices-LocalSessionManager/Operational,,,,25,,]
Type of information: Log
Update interval: 1m

name: User Sign out
Type: Zabbix agent (active)
Key: eventlog[Microsoft-Windows-TerminalServices-LocalSessionManager/Operational,,,,23,,]
Type of information: Log
Update interval: 1m

I have tried making my own calculated item but it does not seem to be working.

name: Amount of Time spent signed in
Type: Calculated
Key: user.session.duration
Type of information: Log
Formula: last("User Sign out") - last("User sign in first time")
Update interval: 1m

You cannot directly subtract log entries in a calculated item because they are not numeric values. To get the time a user has been logged in, you need to capture the timestamp of the last "User signed in" and "User sign out" events. Then, create a calculated item set to numeric type that finds the difference between these timestamps. This difference will give you the session duration in seconds. Make sure your original log items are correctly collecting sign-in and sign-out events, and that the calculated item is configured to handle numeric values rather than log text.