# NQL where

A `where` clause allows you to add conditions to your query to filter the results using [NQL comparison operators](/platform/understanding-key-data-platform-concepts/nexthink-query-language-nql/nql-operators/nql-comparison-operators.md) and [NQL logical operators](/platform/understanding-key-data-platform-concepts/nexthink-query-language-nql/nql-operators/nql-logical-operators.md).

## Comparing field value to a fixed reference

Compare field value to a fixed reference to filter results that match a specific, unchanging criterion. For example:

* Filter devices with a specific operating system.
* Filter devices with free memory below a specified threshold.
* Filter specific binary versions.

### Syntax <a href="#nqlwhere-syntax" id="nqlwhere-syntax"></a>

{% code overflow="wrap" lineNumbers="true" %}

```
...
| where <field name> <comparison operator> <static value>
```

{% endcode %}

### Examples <a href="#nqlwhere-examples" id="nqlwhere-examples"></a>

Select the devices running the Windows operating system.

{% code overflow="wrap" lineNumbers="true" %}

```
devices during past 7d
| where operating_system.platform == Windows
```

{% endcode %}

| Name         | Platform |
| ------------ | -------- |
| nxt-gcarlisa | Windows  |
| nxt-wmirjam  | Windows  |

Select the devices not running the Windows operating system.

{% code overflow="wrap" lineNumbers="true" %}

```
devices during past 7d
| where operating_system.platform != Windows
| list name, operating_system.platform
```

{% endcode %}

| Name        | Platform |
| ----------- | -------- |
| nxt-jdoe    | macOS    |
| nxt-vlatona | macOS    |

Select the users whose name contains “jo”.

{% code overflow="wrap" lineNumbers="true" %}

```
users during past 7d
| where username == "*jo*"
```

{% endcode %}

| Name        |
| ----------- |
| John Fisher |
| John Doe    |

## Comparing two field values against each other

Compare two field values against each other when you wish to filter results based on a dynamic relationship between fields. Only fields from the same table can be compared against each other.

You can compare the following fields:

* native fields
* context fields
* metrics (aliases) computed in the query
* manual custom fields

### Syntax

{% code overflow="wrap" lineNumbers="true" %}

```
...
| where <field-a name> <comparison operator> <field-b name>
```

{% endcode %}

### Examples <a href="#nqlwhere-usingmultipleconditions" id="nqlwhere-usingmultipleconditions"></a>

#### Comparing native fields

Identify users which don't use the same peripheral for both the speaker and the microphone.

{% code overflow="wrap" lineNumbers="true" %}

```
users
| with collaboration.sessions
| where participant_device.microphone != participant_device.speaker
```

{% endcode %}

#### Comparing a native field with a context field

Filter out events where the device has changed location

{% code overflow="wrap" lineNumbers="true" %}

```
connection.events during past 7d
| where destination.country == context.location.country
```

{% endcode %}

#### Comparing native field to computed metric

Identify devices which have not had any Collector activity after an execution crash.

{% code overflow="wrap" lineNumbers="true" %}

```
devices during past 7d
| include execution.crashes during past 7d
| compute last_crash_time = time.last()
| where last_crash_time > last_seen
```

{% endcode %}

#### Comparing native field to a manual custom field

Compare the package version to a required compliant version that is stored in a manual custom field.

{% code overflow="wrap" lineNumbers="true" %}

```
packages 
| where package.version == package.#required_version
```

{% endcode %}

## Using multiple conditions <a href="#nqlwhere-usingmultipleconditions" id="nqlwhere-usingmultipleconditions"></a>

Use multiple filters separated by [NQL bitwise operators](/platform/understanding-key-data-platform-concepts/nexthink-query-language-nql/nql-operators/nql-bitwise-operators.md)(`and` or `or`) to apply more complex conditions. The conditions in the filter are grouped together to preserve the order of precedence. When you put `where` clauses on separate lines, the result is the same as if you created one `where` clause with multiple `and` conditions.

The following queries provide the exact same results.

{% code overflow="wrap" lineNumbers="true" %}

```
devices during past 7d
| where device.entity == "Lausanne" and device.hardware.type == laptop
```

{% endcode %}

{% code overflow="wrap" lineNumbers="true" %}

```
devices during past 7d
| where device.entity == "Lausanne" 
| where device.hardware.type == laptop
```

{% endcode %}


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.nexthink.com/platform/understanding-key-data-platform-concepts/nexthink-query-language-nql/nql-keywords/nql-where.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.