Why is my search producing error "Error in 'eval' command: The expression is malformed..."?

[TheJagoff]

When I enter this search:

sourcetype=win*
(EventCode=4624 OR EventCode=4634)| stats latest(eval(if(EventCode=4624,_time, null()))) as logon_time, latest(eval(if(EventCode=4634,_time,null()))) as logoff_time by User
| eval logoff_time = if(logoff_time < logon_time OR isnull(logoff_time), “Session in Progress”, logoff_time)

I get the error:

Error in 'eval' command: The expression is malformed. An unexpected character is reached at '“Session in Progress”, logoff_time)'.

I can't seem to see where I messed up. Any help or ideas are most appreciated.

Thanks

[woodcock · Accepted solution]

It is almost certainly because you are using Windows/handed/slanted double-quotes (“ ”) instead of low-ASCII/unhanded ("). Cut and paste THIS ONE -> ".

[TheJagoff]

As usual - you are absolutely correct sir. Many many thanks!