NQL where
A where
clause allows you to add conditions to your query to filter the results.
Syntax
...
| where <field name> <comparison operator> <field value>
Examples
Select the devices running the Windows operating system.
devices during past 7d
| where operating_system.platform == Windows
Name | Platform |
---|---|
nxt-gcarlisa | Windows |
nxt-wmirjam | Windows |
Select the devices not running the Windows operating system.
devices during past 7d
| where operating_system.platform != Windows
| list name, operating_system.platform
Name | Platform |
---|---|
nxt-jdoe | macOS |
nxt-vlatona | macOS |
Select the users whose name contains “jo”.
users during past 7d
| where username == "*jo*"
Name |
---|
John Fisher |
John Doe |
Using multiple conditions
Use multiple filters separated by and
or or
operators to apply more complex conditions. The conditions in the filter are grouped together to preserve the order of precedence. When you put where
clauses on separate lines, the result is the same as if you created one where
clause with multiple and
conditions.
The following queries provide the exact same results.
devices during past 7d
| where device.entity == "Lausanne" and device.hardware.type == laptop
devices during past 7d
| where device.entity == "Lausanne"
| where device.hardware.type == laptop