Skip to main content
Skip table of contents

NQL where

A where clause allows you to add conditions to your query to filter the results.

Syntax

CODE
...
| where <field name> <comparison operator> <field value>

Examples

Select the devices running the Windows operating system.

CODE
devices during past 7d
| where operating_system.platform == Windows

Name

Platform

nxt-gcarlisa

Windows

nxt-wmirjam

Windows

Select the devices not running the Windows operating system.

CODE
devices during past 7d
| where operating_system.platform != Windows
| list name, operating_system.platform

Name

Platform

nxt-jdoe

macOS

nxt-vlatona

macOS

Select the users whose name contains “jo”.

CODE
users during past 7d
| where username == "*jo*"

Name

John Fisher

John Doe

Using multiple conditions

Use multiple filters separated by and or or operators to apply more complex conditions. The conditions in the filter are grouped together to preserve the order of precedence. When you put where clauses on separate lines, the result is the same as if you created one where clause with multiple and conditions.

The following queries provide the exact same results.

CODE
devices during past 7d
| where device.entity == "Lausanne" and device.hardware.type == laptop
CODE
devices during past 7d
| where device.entity == "Lausanne" 
| where device.hardware.type == laptop
JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.