What you may have noticed is that there's simply no direct way to confirm, at least via things like security logs, that a PC is still on and in use. This is not really a Splunk-specific problem, but shows up in all sorts of cases and with all sorts of products.
There are partial solutions (And I'm sure others will come up with all sorts of creative ways, maybe one of those will work for you). Here's some notes about this, and perhaps some ideas.
First, how would you define "Logged in to and in use?" I often won't click a button or type a key for a minutes at a time on my PC at work. So, maybe I'm logged into it, but I can't say for sure if it's in use by anything the system is recording or logging. Without a keylogger or any other special software, I'm not sure there's a good way to tell it's in use. So I guess we'll have to assume that by "in use" means "Powered on, with someone logged into it, and without a logoff, sleep, hibernate, or 'lock desktop' event as the latest thing."
Second, by the way, one complication is when someone powers off the computer via inappropriate means (pulling the plug). How would windows "record" the fact that one moment it's working, the next it has no power and is off? It does so at next boot with a special entry saying "The last power off was unexpected". But in the meantime you just have a computer that doesn't respond. This may or may not be a concern.
Third, You've already found the security log logs things, but doesn't just log things to log them. Nowhere, for instance, does it just make an entry "Yo, User X is still logged in and 'doing things'". Indeed, how would you define "doing things?" What a shame, though I guess everyone complains about how chatty Microsoft's event logs are already...
Now, to some possible partial solutions:
A sort-of solution to the "logged in" is simply that there was no log off and no "going to sleep" or "lock desktop". There's a handful of events for logoff and sleep and whatnot that get logged, you could search for those. Hint: they're event id 4634 and others. See this link on audit information in Windows for more. Poke through the Logon, Logoff, and Other Logon/Logoff Events sections.
You could also make a scripted input (or indeed, just a batch file that runs every minute then pick up the output of that) using something like the query user command.
There are other solutions, I think the above information combined with a little searching of the interwebs may get you more information.
