Skip to main content
Skip table of contents

Custom trends management

Custom trends extend the standard Nexthink data model, allowing you to save a daily snapshot of the existing data and observe its evolution over time, for up to 13 months.

You can configure up to 200 custom trends.

Accessing the Custom trends page

  1. Select Administration from the main menu.

  2. Click on Custom trends in the Content management section of the navigation panel.

Accessing Custom trends

Managing custom trends

The custom trends administration page displays the list of custom trends that have already been defined.

  • View the total number of custom trends located on the top-left side of the table.

  • Search for the custom trend by name using a search box located on the top-right side of the page to narrow down the listed results.

Using the custom trend action menu

Hover over a three vertical dot icon of the custom trend to reveal the action menu with the following options:

  • Edit: View details of the custom trend configuration and change the name, description and the NQL query.

  • Edit tags: Add or remove the associated tags.

  • Export: Download and save the custom trend in JSON format.

  • Delete: Remove the custom trend.

Custom trends action menu

Importing custom trends

  1. Click on Import in the top-right corner of the page.

  2. Choose the JSON file of the custom trend you want to import from your device.

All imported items will be categorized as custom content.

Import custom trend

Tagging custom trends

Tagging allows you to efficiently organize custom trends, facilitating quick and easy navigation through your data. Filter the table by typing or selecting Tags from the right-side panel.

Edit custom trend tags

To assign, remove or edit tags:

  1. Hover over a custom trend to display the action menu on the right side of the table.

  2. Click Edit tags to open the Tags pop-up.

  3. Type in a new tag name or choose an existing one to add it to the custom trend.

  4. Open the tag’s action menu to remove the tag from the custom trend or change the tag color. Deleting a tag only removes it from the associated custom trend.

Custom trend tags pop-up

Creating a custom trend

To create a new custom trend:

  1. Click on the New custom trend button in the top-right corner of the Custom trend page.

  2. Enter the Name and Description on the custom trend configuration page.

  3. If needed, adjust the Query ID, the unique identifier for NQL. Remember that once you have created the query, you can no longer change the Query ID value.

  4. Enter an optional Description to help others understand the meaning and purpose of this trend data.

  5. Write the NQL query the Nexthink platform executes during the daily snapshot evaluation.

Creating a custom trend

Writing an NQL queries for custom trends

While writing the query, follow the rules below:

  • The query must target the devices namespace.

  • The time interval allowed for devices is during the past 1d. Omit this time interval to target all devices registered in the system.

  • The query must have a maximum of two include clauses and two compute clauses.

  • The only time interval allowed after the include clauses is during past 1d.

  • Nexthink allows the where clause only when followed by conditions on device properties.

  • The query cannot include personally identifiable information (PII), such as the device name, employee email address, and others.

  • The query must end with a list clause including a maximum of two metrics (numbers) and a maximum of 5 properties (strings or enums).

  • The system does not allow the sort, limit, summarize, countif(), sumif(), or with clauses.

  • Some device properties, such as operating system, location, and organization, are included by default when evaluating the daily snapshots.

Accepting data retention

  • Select the Data retention checkbox to acknowledge that this trend data will be saved in the system for a period of 13 months.

  • Click on the Save button to save your new custom trend.

Using custom trends

After saving the custom trend, you can query the new trend data with NQL. Initially, it yields 0 entries until the system saves the first snapshot.

Here is an example of an NQL query used in a custom trend:

CODE
devices 
| include execution.crashes past 1d 
| compute nb_crashes = number_of_crashes.sum() 
| list nb_crashes , hardware.manufacturer

The custom trends table looks as follows:

Bucket start

Context

Metric

Property

19/01/2024 00:00:00 AM

context information for device 1

nb_crashes for device 1

hardware_manufacturer for device 1

19/01/2024 00:00:00 AM

context information for device 2

nb_crashes for device 2

hardware_manufacturer for device 2

19/01/2024 00:00:00 AM

context information for device 3

nb_crashes for device 3

hardware_manufacturer for device 3

19/01/2024 00:00:00 AM

….

20/01/2024 00:00:00 AM

context information for device 1

nb_crashes for device 1

hardware_manufacturer for device 1

20/01/2024 00:00:00 AM

context information for device 2

nb_crashes for device 2

hardware_manufacturer for device 2

20/01/2024 00:00:00 AM

context information for device 3

nb_crashes for device 3

hardware_manufacturer for device 3

20/01/2024 00:00:00 AM

You can query custom trend data in Investigations or create a dashboard widget to monitor the trend on a timeline. The syntax to retrieve custom trend data is as follows:

CODE
custom_trend.<NQL ID>.snapshots ...
...

When configuring a widget, use the NQL ID of an existing custom trend to visually represent the evolution over time of a specific metric.

Line chart configuration using a custom trend

Recommendations

Using aggregations

Custom trends enable you to incorporate aggregations within your custom trend definition. You can also perform additional aggregations on trend data during retrieval, but it is important to note that snapshots lose the information about the aggregation that was used in the definition.

Let’s consider the following example. The NQL in the custom trend definition creates a snapshot that includes the average boot duration for each device during a given day.

CODE
devices during past 1d
| include device_performance.boots during past 1d
| compute boot_duration = duration.avg()

When retrieving the data you may compute the average of your daily snapshot across all devices.

CODE
custom_trend.#name.shapshots
| summarize c1 = boot_duration.avg() by 1d

In this case, the result returned by the avg() aggregation will simply be the sum of the average values for each device, divided by the number of devices with a boot.

Understanding devices included in custom trend data

In the definition of the custom trend you can specify the set of devices based on their activity.

  • To save snapshots with all the devices registered in the system (which are all the devices that were active in the last 30 days, see Data resolution and retention), omit the time selection for the devices table in the definition of the custom trend.

CODE
devices
| include … during past 1d 
| compute … 
| list …
  • To save snapshots with the devices that were active during the day the snapshot was taken add during past 1d after devices in the definition of the custom trend.

CODE
devices during past 1d
| include … during past 1d 
| compute … 
| list ….

When you haven’t specified the timeframe for the devices, you may expect slight discrepancies in the results when comparing trend data with operational data from the same period.

Applying filters and aggregations at retrieval when possible

We recommend filtering data and applying aggregation on devices during retrieval rather than in the trend definition.

Let’s consider an example where you want to plot the trend line for the number of devices experiencing crashes per hardware manufacturer. There are several strategies possible, but not all of them are optimal.

Suboptimal strategy

A suboptimal strategy would involve creating multiple custom trend definitions, one for each hardware provider, with aggregation on the devices. The following query returns a list of devices indicating 0 when no crashes occurred on a particular device and 1 if at least one crash occurred.

CODE
devices
| where hardware.manufacturer == "my_provider1"
| include execution.crashes past 1d
| compute nb_devices = device.count()
| list nb_devices

When retrieving the custom trend data, no filters are required.

CODE
custom_trend.#name.snapshots during past 300d
| summarize my_provider1_with_crashes = nb_devices.sum() by 1d

Optimal strategy

In the optimal strategy, create one custom trend definition, snapshotting the number of crashes as a metric and the hardware manufacturer as a property:

CODE
devices
| include execution.crashes past 1d
| compute nb_crashes = number_of_crashes.sum()
| list nb_crashes , hardware.manufacturer

When retrieving the custom trend data:

  • Filter devices with at least one crash and relevant hardware provider:

CODE
custom_trend.#name.snapshots during past 300d
| where nb_crashes > 0
| where hardware_manufacturer == "my_provider1"
| summarize my_provider1_with_crashes = count() by 1d
  • Alternatively, use conditional aggregation to summarize only devices with at least one crash and add additional grouping by hardware provider:

CODE
custom_trend.#execution_crashes.snapshots during past 300d
| summarize
fraction_with_crashes_per_manifacturer = countif(nb_crashes > 0) / count()
by 1d, hardware_manufacturer

Keeping track of execution crashes

Track the daily number of execution crashes.

Custom trend definition

CODE
devices
| include execution.crashes past 1d
| compute nb_crashes = number_of_crashes.sum()
| list nb_crashes , hardware.manufacturer

Custom trend data retrieval

You can use the above trend definition, to create the following dashboard:

Trend data dashboard example
  1. Compute the number of devices with crashes and the total number of devices.

    CODE
    custom_trend.#execution_crashes.snapshots during past 90d
    | summarize devices_with_crashes = device.countif(nb_crashes > 0), device_count = device.count()

  2. Observe daily changes of the total number of crashes over the last 90 days.

    CODE
    custom_trend.#execution_crashes.snapshots during past 90d
    | summarize number_of_crashes_ = nb_crashes.sum() by 1d

  3. Observe the total number of crashes per device platform. Include only devices with at least one crash.

    CODE
    custom_trend.#execution_crashes.snapshots during past 90d
    | where nb_crashes > 0
    | summarize number_of_crashes_ = nb_crashes.sum() by context.device_platform
    | sort number_of_crashes_ desc

  4. Observe the total number of crashes, and the number of devices with crashes per device hardware manufacturer.

    CODE
    custom_trend.#execution_crashes.snapshots during past 90d
    | where hardware_manufacturer != "VMWare"
    | where hardware_manufacturer != null
    | summarize number_of_crashes_ = nb_crashes.sum(), number_of_devices_ = device.count() by device.hardware.manufacturer
    | sort number_of_crashes_ desc

Monitoring Windows 11 migration

Track the ratio of devices with Windows 11 over time.

Custom trend definition:

CODE
devices
| where operating_system.platform == windows
| list operating_system.name, hardware.type

Custom trend data retrieval:

CODE
custom_trend.#windows_migration.snapshots during past 300d
| where hardware_type !in [virtual, null]
| summarize ratio_with_windows_11 = countif(operating_system_name == "*windows 11*")/count() by 1d

Monitoring boot duration

Track the average boot durations for each device, to monitor the effect of implementing leaner configurations.

Custom trend definition:

CODE
devices during past 1d
| include device_performance.boots during past 1d
| compute boot_duration = duration.avg()
| list boot_duration, hardware.type

Custom trend data retrieval:

CODE
custom_trend.#boot_duration.snapshots during past 30d
| where (context.device_platform == "Windows" and hardware_type == laptop)
| summarize boot_duration_avg = boot_duration.avg() by 1d

Permissions

You can create custom trends in the Nexthink web interface if your user profile has the Manage all custom trend data permission enabled. Refer to the Profiles documentation for more information.

JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.