Hmm, interesting. Two possibilities:
- Try it with wildcards - *Denied*
- Try building the search directly in nDepth to see if it yields different results than filter send to nDepth
Filters in the monitor tab are real-time, so events appear as soon as they are logged and match the criteria. nDepth searches depend on database/manager time. Are you sure that your manager time is correct so it's stamping events with the right time? What if you expand your nDepth search time-frame, do you start to get results?