Nexthink Query Language (NQL)

Nexthink Query Language (NQL) is the programming language developed by Nexthink and designed to request and retrieve information from the data storage layer. NQL queries extract data and format it into a human-readable form.

Data storage

The Nexthink instance stores the information in various ways optimized for performance and efficiency. When querying data, the system receives statements, groups of commands and clauses written using the Nexthink Query Language (NQL). The information is organized using various containers and stored in one or multiple records called fields.

Fields are either grouped directly in a table, called a collection, or encapsulated in a structured field. One or more collections are contained in only one namespace, but the product relies on several namespaces.

Querying data

Nexthink Query Language (NQL) allows you to investigate and query any data from the Nexthink platform. You can only access the data, you cannot create new records or modify existing ones.

To execute an NQL query, write it in the investigations editor and click the Run button.

50 results are displayed by default. To reveal more results click on the Load more button at the bottom of the page to load another set of 50 results.

NQL terminology

Nexthink uses a specific vocabulary of technical terms to define the various concepts around NQL.

Query

An NQL query is a specific type of NQL statement that successfully executes commands to return data.

binaries

web.events during past 24h
| where application.name == "Confluence"
| summarize usage_hours = duration.sum() / 3600 by device.name, device.operating_system.platform, device.entity
| list device.name, usage_hours, device.operating_system.platform, device.entity
| sort usage_hours desc

An NQL statement is an instruction that successfully executes commands capable of changing data or the schema. The current implementation of NQL available to the public only allows to retrieve data.

Clause

An NQL clause is a command used to filter and analyze data.

| where application.name == "Confluence"

| list device.name, usage_hours, device.operating_system.platform, device.entity

Keyword

An NQL keyword is a reserved term used to construct a statement or a clause. For example:

where summarize list

Operator

An NQL operator is a symbol used to perform an action on one or more items in a statement or a clause. For example:

/ = >

For a list of all the possible operators, have a look at the NQL operators page.