How to calculate how long a user has been signed in for on a Windows VM?

[Person]

Hello,

I'm wondering how I can calculate the time difference of these two items that I made to tell me how long a user has been logged in for.

Here are the items I made that tell me when there has been a logon or a sign out.

name: User signed in
Type: Zabbix agent (active)
Key: eventlog[Microsoft-Windows-TerminalServices-LocalSessionManager/Operational,,,,25,,]
Type of information: Log
Update interval: 1m

name: User Sign out
Type: Zabbix agent (active)
Key: eventlog[Microsoft-Windows-TerminalServices-LocalSessionManager/Operational,,,,23,,]
Type of information: Log
Update interval: 1m

I have tried making my own calculated item but it does not seem to be working.

name: Amount of Time spent signed in
Type: Calculated
Key: user.session.duration
Type of information: Log
Formula: last("User Sign out") - last("User sign in first time")
Update interval: 1m

[cyber]

If you would extract something from log, then you also need to tie it to specific user and somehow keep all that data... becomes too complicated...

Generate a problem, when user logs in and close it when s/he logs out... Problem duration-> how long they stayed logged in..
Plus side, you instantly know, who is logged in...

[BP_Vital]

"eventlog" item returns a log - a heap of text. You can't blindly do math calculations between them.
What you might want to do - try to do use regex and preprocessing magic to extract timestamps of those events and then compare them.

[cyber]

If you would extract something from log, then you also need to tie it to specific user and somehow keep all that data... becomes too complicated...

Generate a problem, when user logs in and close it when s/he logs out... Problem duration-> how long they stayed logged in..
Plus side, you instantly know, who is logged in...