Unbalanced quotes: How to create a search to identify when clients have MFA enabled / disabled?

[sovereign-03]

I am in the process of trying to create a search to identify when clients have MFA enabled / disabled. the purpose of this search is to include date, time, device info, geo location.... basically everything needed so if a account was compromised or MFA was disabled longer then what's allowed you I can document and take appropriate action with client.  

Index=* source=security_logs AND incident_id=0365 AND action=disable AND authentication_type=MFA time>=24h | table user, ip_address, inbound/outbound, time, date, duration | iplocation ip_address | stats latest(time_enabled) as time_enabled | eval days_disabled=round((now()-time_enabled)/(60*60*24)) | table user, ip_address, inbound/outbound, time, date, duration, ip_city, ip_country, days_disabled

[efavreau]

@sovereign-03  You provided the search you're running, but what's the problem? You mention unbalanced quotes in your title, but there's no quotes in your search. Is it that the search won't run, or you aren't getting the results you expected (what are the results you're getting?), or something else? More details may lead to someone being able to help out.