Not sure if you'd want that per user, but here it goes:
index=desktop "Q218" session_id=* Account_Domain=WIN NOT host=MET_IMG NOT user=lab NOT user=PanAgent-svc EventCode=4647 OR EventCode=4624 OR EventCode=4634
| dedup _time user
| stats earliest(_time) AS earliest latest(_time) AS latest BY session_id
| eval duration = tostring((latest-earliest), "duration"), length_seconds=(latest-earliest)
| table user session_id earliest latest duration
| where duration>"00:00:00"
| stats sum(length_seconds) as Total_Length, avg(length_seconds) as Avg_Length by user
| eval Avg_Length_Minutes=Avg_Length/60
... View more