Live Dashboards NQL examples
This list of NQL query examples is designed to help you create Live Dashboards widgets. Go through the queries below and pick the one most similar to the widget you would like to create and the information that you want to display. Copy the query and adjust it to your use case.
KPI widget
NQL structure to create a KPI widget.
CODE
...
summarize <kpi> = <sum() | count() | avg() | max() | min()>
Display the total web application errors during the last 7 days.
CODE
web.errors during past 7d
| summarize total_errors = number_of_errors.sum()
Display the ratio of backend page load duration during the last 7 days.
CODE
web.page_views during past 7d
| summarize backend_dur_ratio = page_load_time.backend.sum() / page_load_time.overall.sum()
Line chart
NQL structure to create a line chart.
CODE
<event table> <time_duration>
...
summarize <kpi1>, <kpi2>, ... by <time_duration_granularity>
(list <time>, <kpi1>, <kpi2>, ...)
Display average daily backend page load duration, client page load duration, and network duration over the last 7 days, without specifying the list line.
CODE
web.page_views during past 7d
| summarize
backend_duration = page_load_time.backend.avg() ,
client_duration = page_load_time.client.avg() ,
network_duration = page_load_time.network.avg() by 1d
Display average daily backend page load duration, client page load duration, and network duration over the last 7 days, using the list line to indicate the parameters that should be included.
CODE
web.page_views during past 7d
| summarize
backend_duration = page_load_time.backend.avg() ,
client_duration = page_load_time.client.avg() ,
network_duration = page_load_time.network.avg() by 1d
| list end_time, backend_duration, client_duration, network_duration
Bar chart
NQL structure to create a bar chart.
CODE
...
summarize <kpi1>, <kpi2>, ... by <segmentation1>, <segmentation2>, ...
Display the number of hard resets and the number of device over the last 7 days, broken down by: platform, hardware manufacturer and model.
CODE
device_performance.hard_resets during past 7d
| summarize
num_hard_resets = number_of_hard_resets.sum() ,
num_devices = device.count()
by
device.operating_system.platform ,
device.hardware.manufacturer ,
device.hardware.model
| sort num_hard_resets desc
Display the number of web transactions by application.
CODE
web.transactions
| summarize nb_transactions = number_of_transactions.sum()
by application.name
| sort nb_transactions desc
Display the Internet Service Provider (ISP) count excluding unknown ISP.
CODE
devices
| where device.public_ip.isp != null
| summarize devices = device.name.count() by device.public_ip.isp
| sort devices desc
Single-metric gauge chart
NQL structure to create a single-metric gauge chart displaying the ratio of devices or users when there is a bad event, for example, a crash. It allows to see how devices or users are affected by the issue.
CODE
<devices|users>
| include <event table>
| compute temp_bad_number = <device|user>.count()
| summarize
<metric> = temp_bad_number.sum(),
<total> = count()
Display the ratio of devices with execution crashes out of all the devices in the company.
CODE
devices
| include execution.crashes
| compute crash_cnt = device.count()
| summarize
devices_with_crashes = crash_cnt.sum(),
total_devices = count()
NQL structure to display the ratio of events when there is an event such as a crash, freeze, hard reset, system reset.
CODE
<devices|users>
| include <bad event table>
| compute temp_metric_number = count()
| include <total event table>
| compute temp_total_number = count()
| summarize
<metric> = temp_metric_number.sum(),
<total> = temp_total_number.sum()
Display the ratio of poor quality collaboration sessions out of the total number of sessions.
CODE
devices
| include collaboration.sessions
| where video.quality == poor or audio.quality == poor
| compute num_poor_quality_sessions = id.count()
| include collaboration.sessions
| compute num_total_sessions = id.count()
| summarize
poor_quality = num_poor_quality_sessions.sum(),
acceptable_quality = num_total_sessions.sum()
NQL structure to display the score metric.
CODE
<score table>
| summarize <metric> = <score_field>.avg(), <total> = <total>
Display the DEX score.
CODE
dex.scores
| summarize score = value.avg() , total = 100
Multi-metric gauge chart
NQL structure of a multi-metric gauge chart displaying the ratio of devices or users with bad events against objects without them.
CODE
<devices|users>
| include <event table>
| compute temp_bad_number = <device|user>.count()
| summarize
<good_label> = count() - temp_bad_number.sum(),
<bad_label> = temp_bad_number.sum()
Display the ratio of devices with crashes against those without them.
CODE
devices
| include execution.crashes
| compute crash_cnt = device.count()
| summarize
without_crashes = count() - crash_cnt.sum(),
with_crashes = crash_cnt.sum()
Display the ratio of devices with bad events against devices without them.
CODE
devices
| include <bad event table>
| compute temp_bad_number = count()
| include <total event table>
| compute temp_total_number = count()
| summarize
<good_label> = temp_total_number.sum() - temp_bad_number.sum(),
<bad_label> = temp_bad_number.sum()
Display the ratio of devices with hard resets against the ones without them.
CODE
devices
| include device_performance.hard_resets
| compute hard_reset_cnt = number_of_hard_resets.sum()
| include device_performance.events
| compute total_cnt = count()
| summarize
no_hard_resets = total_cnt.sum() - hard_reset_cnt.sum(),
hard_resets = hard_reset_cnt.sum()
NQL structure to display the ratio of events with a good state against events with a bad state.
CODE
<devices|users>
| include <event table>
| where <condition is bad>
| compute temp_bad_number = <device|user>.count()
| include <event table>
| where <condition is good>
| compute temp_good_number = <device|user>.count()
| summarize
<good_label> = temp_good_number.sum(),
<bad_label> = temp_bad_number.sum()
Display the ratio of page views with good experience against the ones with a frustrating experience.
CODE
users
| include web.page_views
| where experience_level == frustrating
| compute frustrating_cnt = user.count()
| include web.page_views
| where experience_level == good
| compute good_cnt = user.count()
| summarize
good = good_cnt.sum(),
frustrating = frustrating_cnt.sum()
NQL structure to display a ratio of users or devices with a good state against the ones with a bad state.
NONE
<devices|users>
| include <event table>
| where <condition is bad>
| compute temp_bad_number = <sum|count>
| include <event table>
| where <condition is good>
| compute temp_good_number = <sum|count>
| summarize
<good_label> = temp_good_number.sum(),
<bad_label> = temp_bad_number.sum()
Display the ratio of page views with good experience against the ones with a frustrating experience.
CODE
users
| include web.page_views
| where experience_level == frustrating
| compute frustrating_cnt = number_of_page_views.sum()
| include web.page_views
| where experience_level == good
| compute good_cnt = number_of_page_views.sum()
| summarize
good = good_cnt.sum(),
frustrating = frustrating_cnt.sum()
RELATED TOPICS