Investigations along with the new Nexthink Query Language (NQL) are released as a technical preview.


Investigations is the Portal dashboard offering a web-based user interface that allows investigations to be written and executed using the Nexthink Query Language (NQL). The embedded syntax editor allows the parameters of existing queries to be adjusted or the creation of new ones from scratch. The results allow to you investigate issues and problems that the employees of your organization are experiencing.

Investigations are interconnected with other dashboards such as Application Experience through the Investigate more side panel, which automatically generates NQL statements based on user-selected filters.

From Nexthink Experience 2022.1 released on January 17, the platform uses a new version of NQL for everything. This new version introduces major improvements when querying the data storage layer while offering more flexibility to organize the results. For more information, please read the NQL 2.x changes article.

Advantages of using Investigations

  • Get any Nexthink data such as Collector data, data coming from integrations and external sources, or Application Experience data, centralized in a single place. You can focus on the data without worrying about the database or how it is stored.

  • Use a powerful editor with autocomplete functionality to make your code mistake-proof and get hints on the next keyword or field to be used.

  • Run suggested investigations that provide guided navigation through Nexthink data without writing a single line of code.

  • Use drill-downs to get items related to the list of results while keeping the context of your investigation, that is, enforcing the time frame and the conditions of the original investigation.

Accessing Investigations

To enable Investigations, please contact Nexthink Support. In order to access the Investigations dashboard, the Investigations check box must be ticked in the user’s profile. The user permissions must include an unrestricted view domain.

After access is granted, the Investigations icon will appear in the main navigation bar.

Investigations in the main navigation bar

Drill-downs in web investigations

The Drill-downs option from the action bar provides multiple opportunities to narrow down your search by getting items relevant to the investigation results. The drill-downs work within the context of the query, enforcing the time frame and the conditions of the original investigation. The action bar automatically appears at the bottom of the screen once a query is executed.

Follow these steps to perform a drill-down:

  1. Write a query and press the Run button, a list of results will appear.

  2. Select the items from the result list that you wish to perform the drill-down on.
    Once the first item is selected the action bar appears indicating the number of selected entries along with the Drill-downs button.

  3. Click on the Drill-downs button.

  4. Select the type of drill-down you wish to perform from the pop-up menu.

Saving and sharing investigations

Investigations can be saved for future reference and shared with your colleagues.

Follow these steps to access, run and save your investigations:

  • Click on the investigation icon in the main navigation bar on the left to reveal the list of saved investigations.

  • From the list, select Investigate at the top of the list to create a new investigation.

  • Write your NQL queries and press Run to see the results.

  • Save your investigation by pressing the Save button.

  • Enter the name of the investigation in the pop-up and press Done.

Every time you make changes to an existing investigation press Save to update it.

You may Edit and Delete an existing investigation by pressing on the action menu. Ensure you save the investigation after you edit its name.

Click on the Share button to copy the link to the investigation. This can then be shared with colleagues who have access to the investigations feature. You may share your investigations at any time, without saving them first.

Applying privacy policy to investigations

There are four levels of data privacy defined in the account profile that specify access rights and are relevant to data visibility in the Investigations dashboard.

  • Anonymous users, devices, destinations and web domains: The names of users, devices, destinations, and web domains are not visible to the account. Please note that destinations and web domains do not apply to NQL.

  • Anonymous users and devices: The names of users and devices are not visible to the account.

  • Anonymous users: Only the names of users are not visible to the account.

  • None (full access): There are no restrictions, all names are visible.

Visit the Establishing a privacy policy document for more information on various privacy options and how they are applied to Nexthink Experience.

When a certain anonymization level is applied to the user profile, it will affect the way information in the Investigations dashboard is displayed. As seen in the illustration below, the User username and User type columns of the navigations table are displayed as hidden.