Yes, that is the correct expression to restrict createdate to the last 24 hours.

Your query is also restricting the results to Windows authenticated logins (isntname=1), so you wouldn't see any SQL authenticated logins that had been created.

Perhaps that is the issue?

Cheers!