Help with Windows dormant enable search

[debjit_k]

Hi All, 

I want to create a use case where the account is inactive for 60 days and it got enable after 60 days.. 

I tied to draw ta logic but not sure whether query is correct or not.

Can somebody please modify the query if it required some change 

index=wineventlog EventCode=4624 user=”*@xyz.com" earliest= -60d latest = now() | transaction user maxspan=60d search (EventCode!=)

Thank you