No Event Code 1024 appear

Splunk Search

Hello everyone,

I have the following inputs.conf file which is actually working for the first 2 stanza, but not for the third one. could someone please tell me why? I do not get any events from them.

[WinEventLog://Security]
disabled = 0
renderXml = 1
start_from = oldest
current_only = 0
evt_resolve_ad_obj = 1
checkpointInterval = 5
sourcetype = XmlWinEventLog
index = ad
whitelist1=4624,4769,4728,4732,4756,4761,4751,4746

# This stanza will send all events for the event_code 21
[WinEventLog://Microsoft-Windows-TerminalServices-LocalSessionManager/Operational]
disabled = 0
renderXml = 1
sourcetype = XmlWinEventLog
index = ad
source="XmlWinEventLog:Microsoft-Windows-TerminalServices-LocalSessionManager/Operational"
whitelist2=21

# This stanza will send all events for the event_code 1024
[WinEventLog://Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational]
disabled = 0
renderXml = 1
sourcetype = XmlWinEventLog
index = ad
source="XmlWinEventLog:Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational"
whitelist3=1024

Thank you very much for helping me!

Get Updates on the Splunk Community!

Deep Dive: Accelerate threat investigation with Splunk’s AI Assistant in Security

AI is one of the biggest topics in the market today, and for security teams, its value goes far beyond the ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Detection Engineering Office Hours: Real-World Troubleshooting & Q&A

[REGISTER HERE] This thread is for the Community Office Hours session on Detection Engineering Office Hours: ...