Like I said, there's no easy way to gather this information cleanly. Event ID 4001 only tells you that a user attempted to logon. It doesn't tell you whether or not the user is still logged on. Event ID 4002 tells you that the user logged off.
You could substring User ID's, compare Event ID's and DateTime values. Frankly, its a pain, especially when you can use the the server software mentioned above.