Timeframe picker

This page details how Nexthink implements the timeframe picker and time granularity into the NQL queries to filter and adjust dashboard visualizations.

All dashboards have the option of predefined and custom timeframes which applies to all dashboard tabs. In addition, you can pick and modify the time granularity for line charts.

Refer to Using Live Dashboards documentation to learn how to pick timeframes.

Predefined timeframes

The predefined timeframes available are:

• Last hour

• Last 6 hours

• Last 24 hours

• Last 7 days

• Last 30 days

• Last 90 days

• Last 6 months

• Last 1 year

Depending on the predefined timeframe you choose, you can set different levels of time granularity to identify patterns and troubleshoot issues. The Custom date and Time range section delves into custom timeframes and their default granularities implemented in NQL queries.

Last hour

The dashboard applies the following NQL time specification to the queries:

during past 60min
...
(by 15 min)

NQL will return four, 15-minute buckets.  The amount of data that the last 15-minute bucket contains depends on what time the user loads the dashboard. This means that for the last hour, the user will see anywhere from 45 minutes of data to 59 minutes of data.

Viewer time = 18:39

During past 1h does not equal During past 60 min

NQL currently interprets during past 1h differently from during past 60min. To ensure consistency between the results in Investigations and in Live Dashboards, use during past 60min in widgets' queries.

• Examples of during past 1h.

execution.events during past 1h
| summarize num_freezes = number_of_freezes.sum() by 15min

The data starts from the beginning of the last full hour.

Viewer time = 18:39

Last 6 hours

The dashboard applies the following NQL time specification to the queries:

during past 360min
...
(by 15min)

NQL returns twenty-four, 15-minute buckets.  The amount of data that the last 15-minute bucket contains depends on what time the user loads the dashboard. This means that for the last 6 hours, the user can see anywhere from 5 hours 45 minutes of data to 5 hours 59 minutes of data.

• Example of during past 360min

Viewer time = 18:39

Last 24 hours

The dashboard applies the following NQL time specification to the queries:

during past 24h
...
(by 1h)

NQL returns twenty-four, 1-hour buckets. The amount of data that the last 1-hour bucket contains depends on what time the user loads the dashboard.  This means for that for the last 24 hours, the user can see anywhere from 23 hours of data to 23 hours 59 minutes of data.

• Example of during past 24h

Viewer time = 18:39

Last 7 days

The page applies the following NQL time specification to the queries:

during past 7d
...
(by 1d)

NQL returns seven, 1-day buckets. The amount of data that the last 1-day bucket contains depends on the time that the user loads the dashboard. This means that for the last 7 days, the user can see anywhere from 6 days of data to 6 days 23 hours 59 minutes of data.  

The start of the day is defined by the timezone that the server is located in.  

• Example where the viewer timezone matches the server timezone:

Viewer time = April 13, 18:39 Eastern Time (GMT-4)
Server time = April 13, 18:39 Eastern Time (GMT-4)

• Example where the viewer timezone does not match the server timezone:

Viewer time = April 13, 18:39 Eastern Time (GMT-4)
Server time = April 13, 15:39 Pacific Time (GMT-7)

Last 30 days

The page applies the following NQL time specification to the queries:

during past 30d
...
(by 1d)

NQL returns thirty, 1-day buckets. The amount of data that the last 1-day bucket contains depends on the time that the user loads the dashboard. This means that for the last 30 days, the user can see anywhere from 29 days of data to 29 days 23 hours 59 minutes of data.  

The start of the day is defined by the timezone that the server is located in.  

• Example where the viewer timezone matches the server timezone:

Viewer time = April 13, 18:39 Eastern Time (GMT-4)
Server time = April 13, 18:39 Eastern Time (GMT-4)

• Example where the viewer timezone does not match the server timezone:

Viewer time = April 13, 18:39 Eastern Time (GMT-4)
Server time = April 13, 15:39 Pacific Time (GMT-7)

Last 90 days

The page applies the following NQL time specification to the queries:

during past 90d
...
(by 7d)

NQL returns ninety, 1-day buckets. The amount of data that the last 7-day bucket contains depends on the time that the user loads the dashboard. This means that for the last 90 days, the user can see anywhere from 89 days of data to 89 days 23 hours 59 minutes of data.  

The start of the day is defined by the timezone that the server is located in.  

Last 6 months

The page applies the following NQL time specification to the queries:

during past 180d
...
(by 30d)

NQL returns one hundred and eighty, 1-day buckets. The amount of data that the last 30-day bucket contains depends on the time that the user loads the dashboard. This means that for the last 180 days, the user can see anywhere from 179 days of data to 179 days 23 hours 59 minutes of data.  

The start of the day is defined by the timezone that the server is located in.  

Last 1 year

The page applies the following NQL time specification to the queries:

during past 365d
...
(by 30d)

NQL returns three hundred and sixty-five, 1-day buckets. The amount of data that the last 30-day bucket contains depends on the time that the user loads the dashboard. This means that for the last 365 days, the user can see anywhere from 364 days of data to 364 days 23 hours 59 minutes of data.  

The start of the day is defined by the timezone that the server is located in.  

Custom date and time range

According to your timeframe customization, the system uses a default time granularity.

However, you can modify the time granularity by using the dropdown in the top-right corner of the Dashboard page. As mentioned, refer to Using Live Dashboards documentation to learn how to pick timeframes.

Remember, the time granularity dropdown only updates line charts.

Daily granularity

When you only select dates without selecting the time, the dashboard applies the following NQL time specification to the queries:

NQL time specification:

from <start day> to <end day + 1 day>

(by 1d)

Nexthink does not support time selection for a duration longer than 3 days. If you try to do so, the system will apply the time specification as in the example above.

This translates to different time spans, depending on the underlying data and any differences between the user’s timezone and the server's timezone.

Bucketized events

For bucketized event data, this returns the last 7 complete days and the current day, where the day is defined as midnight to midnight of the server’s timezone. Midnight server time is converted to the user’s timezone if they differ.

Selected range = April 1st to April 3rd
Viewer time = April 13, 18:39 Eastern Time (GMT-4)
Server time = April 13, 16:39 Mountain Time (GMT-6)

Punctual events

For punctual event data, this returns the last 7 complete days and the current day, where the day is defined as midnight to midnight of the user’s timezone.

Selected range = April 1st to Apr 3rd
Viewer time = April 13, 18:39 Eastern Time (GMT-4)
Server time = April 13, 16:39 Mountain Time (GMT-6)

Hourly granularity

If your selected time duration is between 6 hours and 3 days, the system applies the following NQL time specification to queries:

from <start day, start time> to <end day, end time>

(by 1h)

15 min granularity

If your selected time duration is less than 6 hours, the system applies the following NQL time specification to queries:

from <start day, start time> to <end day, end time>

(by 15min)

Applying time duration and granularity 

The dashboard applies the timeframe picker duration and granularity to all places in the query where the time duration or granularity can be applied.

The following scenarios exemplify query changes based on timeframes and granularity combinations.

Event table with no time specification

Original query in a widget:

execution.crashes
| summarize num_crashes = number_of_crashes.sum()

Modified query:

execution.crashes <timepicker period>
| summarize num_crashes = number_of_crashes.sum()

Event table with a time specification

Original query in a widget:

execution.crashes during past 1h
| summarize c1 = number_of_crashes.sum() by 15min
| asc start_time

Modified query:

execution.crashes <timepicker period>
| summarize c1 = number_of_crashes.sum() by <timepicker granularity>
| asc start_time

Object table with with or include clauses

Original query in a widget:

binaries
| with execution.crashes during past 1h
| summarize total = number_of_crashes.sum()

Modified query:

binaries
| with execution.crashes <timepicker period>
| summarize total = number_of_crashes.sum()

devices, users, and binaries tables.

Original query in a widget:

devices
| summarize c1 = count()

Modified query:

devices <timepicker period>
| summarize c1 = count()

Granularity and charts

As mentioned before, the time granularity only changes the intervals for the line charts. 

For all other charts, the granularity has no impact. For example, let's say you have a KPI that displays the average CPU usage:

device_performance.events
| summarize c1 = cpu_usage.avg()

If you select the Last 24 hours option in the timeframe picker, the updated query will be:

device_performance.events during past 24h
| summarize c1 = cpu_usage.avg()

Despite the line charts being shown as data points per hour, this query would be an average of the 15-minute bucket averages.

NQL examples

Refer to the Live Dashboards NQL examples documentation for more information.

RELATED TOPIC

• KPI

• Line chart

• Bar chart

• Single-metric gauge chart

• Multi-metric gauge chart

• Table

• Heading

• Filter widget