Skip to main content
Skip table of contents

Visual editor

Nexthink Query Language (NQL) allows you to investigate and query any data from the Nexthink platform. You can use the Visual editor to create powerful and flexible investigations without the need to master the NQL syntax or data model. You can query any data stored by your Nexthink instance using the visual editor.

The visual editor is a graphical NQL tool that allows you to:

  • List a collection of objects such as users, devices, binaries or events such as execution crashes.

  • Add additional columns with various properties and metrics.

  • Fine-tune the results using conditions.

  • Visualize the results in a table.

  • Apply multiple filters based on properties and metric values.

  • Switch between visual and text editors or use both modes of building queries when needed.

Accessing the Visual editor

  • Select Investigations from the main menu.

  • Click on an existing investigation in the navigation panel or on a New button to start building your NQL query. The Visual editor tab opens by default.

Choosing a data collection

By default, the editor selects the inventory object Devices. It contains all the devices in the environment.

Display drop-down menu

Use the Display drop-down menu to select any other data collection. Inventory objects such as users, devices and binaries are available in addition to events such as execution crashes and device performance.

After selecting data collection, a set of default columns appears in the result table.

Adjusting the timeframe

Unlike in the NQL editor, the time frame selection is mandatory to query objects and events when using the visual editor. The time frame by default is Past 7 days, but you can change it.



For objects, the timeframe limits the results only to active inventory during the selected timeframe. This means that the system detected the objects during the selected time frame. The same timeframe automatically applies to any metric columns the system computes for a given object.

Note that the source collection and computed metric have the same timeframe. Here is an example of the NQL syntax used by the visual editor:

devices during past 7d 
| include execution.crashes during past 7d 
| compute number_of_crashes__0 = crash.number_of_crashes.sum()


When querying events, the selected time frame limits the results to events within the selected time period.

Saving an investigation

Click on the Save as button at the top-right corner of the page to save the investigation. Your saved investigations appear on the Manage Investigations page as well as in the navigation panel for the module.

Save as button

If you are editing an existing investigations, you can:

  • Click on Save to save the changes.

  • Click on Save as to save it under a different name.

Investigations page action menu

Click on the action menu at the top right of the page to:

  • Share: Share an investigation with groups of users based on their user profile and collaborate with them on an investigation. Grant permissions to other users to view or edit the investigation. Refer to the Sharing an investigation section of the Manage Investigations documentation for more information.

  • Copy link: Copy the link to the investigation and share it with other users of Nexthink. Copy link shares the query text in the URL and is always treated as a new investigation for the user you are sending the link to.

  • Export results: The Nexthink platform creates a copy of the data returned by the investigation and stores it in a CSV file. By default, the visual editor limits the maximum number of query results to 10,000 rows on the web page. The export to CSV feature returns up to 1,000,000 rows.

  • Rename: Change the name of an existing investigation.

  • Delete: Remove an existing investigation from the system.

Investigations page action menu

Adding a field

You can change which columns are displayed as a result of the investigations by selecting the Add field action button in the right-side panel. Once activated, the Add field dialog box appears.

Adding a field modal


The system organizes all available properties and metrics from the source collections and associated collections into categories listed in the left panel. It lists all fields added to the investigations from the selected category on the right side of the main area of the dialog box.

Default and selected columns

Selected fields are visible in the upper section of the dialog box. When you start creating investigations, the default fields are already selected.

Add and remove columns

Use the Add field dialog box to complete the following actions:

  • Search for available fields using the search bar.

  • Remove fields using the X button from the selected field section.

  • Navigate through the available properties and event categories to see all fields available from the given category.

  • Add one or more columns to the display area by clicking on the field.

You can add optional conditions if you select the metric field. After choosing the properties and fields to be added to the display, confirm the choice by clicking the Done button.

Set conditions on the metric

Select metric fields multiple times and add different conditions for the same metric.


Select Incoming traffic multiple times and add conditions on different binary names to create two separate columns Teams traffic and Zoom traffic.

Click the Add condition button to add a new condition to the metric.

Use the drop-down menu to choose the source collections and the property you want to use to restrict the metric.

You can add multiple conditions to the query. Adding more conditions automatically adds the and logical operator between them.

Adding a condition

The autocomplete service suggests existing values when typing the property value to restrict the metric. You can also use wildcards:

* to substitute for zero or more characters

? to substitute for zero or one character

You must press the enter key to confirm the entry for values that have not been autocompleted. Adding more values automatically adds the or logical operator between them.

Default aggregation

The system uses the default aggregation after you add the metric column. The visual editor does not currently support changing the default aggregation. Switch to the NQL editor to check the active aggregation method.

Below is an example of a sum aggregation function applied to the selected metric on the number of crashes:

devices during past 7d
| include execution.crashes during past 7d
| compute number_of_crashes__0 = crash.number_of_crashes.sum()
| list device.entity, device.hardware.model, device.hardware.type,, number_of_crashes__0

Filtering the result table

You can further restrict the investigation results by filtering items directly from the result table.

Filtering from the cell’s action menu

You can add simple filters directly from the cell containing the value of the column by clicking on the action menu.

Filtering from the cell action menu

Filtering from the header’s action menu

The Add filter… option in the column header allows you to define filter conditions with more flexibility.

Filtering from the header of the column

When adding a filter from the column header, choose the condition operator and one or multiple values for the conditions, depending on the data type of the field for which you’re adding the filter.

Set filter modal from the column header

Removing and editing filters

The visual editor supports multiple filters at the same time. Find all filters at the top of the dashboard. Remove or edit any filter using the action menu.

Remove and edit filters

Summarizing the results

Summarize gives the ability to aggregate Nexthink data in a way that is easier to understand. With just a few clicks, you can display metrics and break them down into groups and time periods. Using the NQL summarize statement, such breakdowns are particularly useful for identifying patterns and trends.

Entering the summarize mode

The summarize toggle indicates if the data displayed is aggregated or not. There are two ways to enter the summarize mode.

Using the toggle

Summarize toggle

The Summarize results toggle in the right-side panel is off by default for objects and punctual events and on by default for sampled events.

Using the column headers

Summarize in the columns header

An action menu appears in the column headers and in the items in the fields panel for metrics and properties. 

  • A property describes the characteristics of an object or an event. For example, the name and size of a binary.

  • A metric is a numerical value such as the CPU time of a binary.

Generally, metrics are aggregated, while properties are used in a group by clause.

Only properties with specific data types are supported in the group by clause (string, UID, boolean, enumeration, version).

Exiting summarize mode

Exiting the summarize mode is possible only via the toggle.

Adding filters when in summarize mode

Filters can be added via the usual interface.

When in summarize mode:

  • Filters on properties used in the group by are reflected in the results.

  • Filters on metrics have an effect on the raw data before the summarize.

Adding fields when in summarize mode

Fields can be added via the usual interface.

When in summarize mode:

  • When adding properties of supported data types (string, UID, boolean, enumeration, version), the property will be added to the list of results as a "group by" field. Other types are not supported.

  • When adding metrics, they are by default added to the list of results and are already aggregated by default.

Switching from the visual to the NQL editor

Investigations created in the visual editor always have an associated NQL query that you can view by switching to the NQL editor tab. Nexthink provides both modes of creating NQL queries for a better user experience.

In addition to viewing a query, you can modify it as well. If the visual editor supports the modifications, you can switch back to Visual editor and continue modifications.

If the visual editor does not support modifications typed into the NQL editor, you must decide to either switch to the visual editor and lose all modifications or stay in the NQL editor.

Incompatible NQL query message

Supported NQL statements

The visual editor does not have all the extended capabilities of the NQL editor. While it is already a powerful tool for investigating all data available in your Nexthink instance, the NQL editor remains the preferred tool for more advanced queries.

The visual editor continues to evolve and is bringing more and more advanced features of NQL to the visual mode.

The system does not currently support the following features when using the visual builder:

  • Changing aggregation of the metrics

  • with clause (all metrics from associated events are added using “include”)

  • sort clause on multiple columns

  • limit clause

  • Complex filters using the or operator
    (except for strings and enums, within the filter of one field)

  • Combination of or and and


JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.