i can't seeing Windows Event 1102 - Splunk Community

Getting Data In

In my Splunk Enterprise instance, i can't seeing the windows event "1102" from W10 client.

Someone can me help ?

Have you verified that the event is being generated on the W10 client?

Is the Windows 10 in a domain?

Event 1102 is logged whenever the Security log is cleared,
REGARDLESS of the status of the Audit System Events audit policy.
Source: https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=1102

Get Updates on the Splunk Community!

Developer Spotlight with Denis Gladkikh

From Splunk Engineer to Kubernetes App Builder Denis GladkikhWhat happens when a lifelong developer turns a ...

Governing Enterprise AI, Bringing Cisco Telemetry Home, and More from Splunk Lantern

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

The Problem: Too Many Alerts, Too Little Context Security operations teams running Splunk Enterprise Security ...