# NQL time selection In NQL you can specify the time frame in various formats. ## Time selection formats ### NQL during past The `during past` clause allows you to filter your results by specifying a particular time period leading up to the present. The time can be expressed in minutes, hours, or days. **Examples:** Retrieving the number of navigations in the past 45 minutes. {% code overflow="wrap" lineNumbers="true" %} ``` web.page_views during past 45min | summarize total_navigations = number_of_page_views.sum() ``` {% endcode %} Retrieving the number of navigations in the past 1 hour. {% code lineNumbers="true" %} ``` web.Page_views during past 1h | summarize total_navigations = number_of_page_views.sum() ``` {% endcode %} Retrieving the number of navigations in the past 12 hours. {% code overflow="wrap" lineNumbers="true" %} ``` web.Page_views during past 12h | summarize total_navigations = number_of_page_views.sum() ``` {% endcode %} Retrieving the number of navigations in the past 3 days. {% code overflow="wrap" lineNumbers="true" %} ``` web.Page_views during past 3d | summarize total_navigations = number_of_page_views.sum() ``` {% endcode %} ### NQL from to The `from to` clause allows you to apply custom timeframe filters by specifying the start and end times for the desired period. #### Specifying a fixed timeframe Apply a timeframe filter by specifying fixed datetime values for the start and end of the period. **Examples:** The number of navigations `from June 1, 2023 to June 15, 2023` {% code overflow="wrap" lineNumbers="true" %} ``` web.page_views from Jun 1, 2023 to Jun 15, 2023 | summarize total_navigations = number_of_page_views.sum() ``` {% endcode %} The number of navigations `from June 15, 2023 at 12:30 to June 15, 2023 at 16:15` {% code overflow="wrap" lineNumbers="true" %} ``` web.page_views from Jun 15, 2023, 12:30 to Jun 15, 2023, 16:15 | summarize total_navigations = number_of_page_views.sum() ``` {% endcode %} The number of navigations `from 2023-02-01 00:00:00 to 2023-02-28 23:45:00` {% code overflow="wrap" lineNumbers="true" %} ``` web.page_views from 2023-02-01 00:00:00 to 2023-02-28 23:45:00 | summarize total_navigations = number_of_page_views.sum() ``` {% endcode %} The number of navigations `from 2023-02-01 to 2023-02-28` {% code overflow="wrap" lineNumbers="true" %} ``` web.page_views from 2023-02-01 to 2023-02-28 | summarize total_navigations = number_of_page_views.sum() ``` {% endcode %} For more information about the allowed date formats, refer to the [NQL data types](/platform/understanding-key-data-platform-concepts/nexthink-query-language-nql/nql-syntax-overview/nql-data-types.md) section. Note that the autocomplete functionality in the NQL editor provides suggestions with available data formats. #### Specifying a relative timeframe Apply a timeframe filter by defining a time window relative to the current time, for example: `15m ago`, `2h ago`, `1d ago`. The time can be expressed in minutes, hours or days. **Examples:** The number of navigations from the previous day. {% code overflow="wrap" lineNumbers="true" %} ``` web.page_views from 1d ago to 1d ago | summarize total_navigations = number_of_page_views.sum() ``` {% endcode %} The number of navigations grouped into 7-day intervals over a consecutive three-week period. {% code overflow="wrap" lineNumbers="true" %} ``` devices | include web.page_views from 21d ago to 13d ago | compute week1 = number_of_page_views.sum() | include web.page_views from 14d ago to 8d ago | compute week2 = number_of_page_views.sum() | include web.page_views during past 7d | compute current_week = number_of_page_views.sum() ``` {% endcode %} ### NQL on The `on` clause allows you to select a specific day when querying data. **Examples:** The number of navigations `on July 15, 2023` {% code overflow="wrap" lineNumbers="true" %} ``` web.page_views on Jul 15, 2023 | summarize total_navigations = number_of_page_views.sum() ``` {% endcode %} {% code overflow="wrap" lineNumbers="true" %} ``` web.page_views on 2023-06-15 | summarize total_navigations = number_of_page_views.sum() ``` {% endcode %} ## Timeframe behavior for joined tables When joining object and event tables using the `with` or `include` clause, the timeframe of the base table is applied to all subsequent clauses unless a timeframe is explicitly defined in an `include` or `with` clause. This ensures the query is evaluated over a single, consistent time window. This behavior is illustrated in the following examples. #### Example 1: Base object table timeframe specified In this case, a timeframe is defined for the base table, which propagates to all `include` and `with` clauses unless they override it explicitly. Therefore, the following query includes device performance events only from the past 7 days. {% code lineNumbers="true" %} ``` devices during past 7d | include device_performance.events | compute avg_installed_memory = installed_memory.avg(), used_memory_percentage = used_memory.avg()*100/installed_memory.avg() | where used_memory_percentage > 75 ``` {% endcode %} #### Example 2: Base object table timeframe overruled In this case, the `devices` dataset is evaluated over the past 30 days. However, the `execution.crashes` dataset is evaluated only over the past 7 days because the `include` clause explicitly overrides the inherited timeframe. This allows queries to combine a broader entity selection window with a narrower event analysis window when needed. {% code lineNumbers="true" %} ``` devices during past 30d | include execution.crashes during past 7d | compute nb_crashes = number_of_crashes.sum() | list nb_crashes, hardware.manufacturer ``` {% endcode %} #### Example 3: No timeframe specified anywhere In this case, the default timeframe of the base object table is still applied to the entire query, including included datasets. Therefore, in the following query, the default timeframe of the `users` table (which is 90d) is applied across the whole query, including the campaign responses (which themselves are kept for 395d). {% code lineNumbers="true" %} ``` users | include campaign.fuse_it_or_lose_it.responses | where parameters.application_name == "Cisco Jabber" ``` {% endcode %} ## NQL datetime functions You can further customize your time selection with an [NQL where](/platform/understanding-key-data-platform-concepts/nexthink-query-language-nql/nql-keywords/nql-where.md) conditions, to specify time windows relative to points in time other than the current time, for example, business hours, business week, or specific days of the month. Refer to [NQL datetime functions](/platform/understanding-key-data-platform-concepts/nexthink-query-language-nql/nql-functions/nql-date-time-functions.md)for more information. ## Time granularity and retention You have the flexibility to choose the precision level for time selection. Use minutes or hours in NQL time specification to retrieve more granular data. Use days to retrieve less granular data typically covering a longer time span. When specifying timeframes at the **day level,** without a specific time (for example, `during past 2d`, `June 1, 2023` or `1d ago`), the system defaults to include: * **Start of the period:** 00:00:00 (midnight) on the start date. * **End of the period:** 23:59:59 on the end date. This ensures that the entire day(s) within the specified range are included. {% hint style="info" %} Data storage and granularity also depend on specific tables. Refer to the [Data resolution and retention](/platform/understanding-key-data-platform-concepts/data-resolution-and-retention.md) documentation page for more details. {% endhint %} ### Retrieving high-resolution data for Desktop Virtualization By default, VDI event data are available with 5-minute or 1-day resolution, [depending on time selection](/platform/understanding-key-data-platform-concepts/data-resolution-and-retention.md#dataresolutionandretention-eventdataresolution) in your NQL query. To increase VDI data resolution, add `by 30s` at the end of the time selection in the query. High-resolution data is available for the past 2 days. The examples below show how to retrieve high-resolution data from `vdi_events`. #### Increasing data resolution from 1 day to 30 seconds. {% code lineNumbers="true" %} ``` session.vdi_events during past 1d by 30s ``` {% endcode %} {% code lineNumbers="true" %} ``` session.vdi_events on 2024-08-04 by 30s ``` {% endcode %} #### Increasing data resolution from 5 minutes to 30 seconds. {% code lineNumbers="true" %} ``` session.vdi_events during past 24h by 30s ``` {% endcode %} {% code lineNumbers="true" %} ``` session.vdi_events from Nov 08, 2024, 15:15 to Nov 08, 2024, 17:30 by 30s ``` {% endcode %} ## Timezones When the Nexthink cloud instance is located in a different timezone from that of the user, the time selection units determine which timezone is considered for defining the beginning and end of the specified time period. * Full-day timeframes (for example, `during past 2d`, `from 2024-02-07 to 2024-02-08`, `on Feb 8, 2024`) use the cloud instance timezone. * Timeframes expressed in hours and minutes (for example, `during past 15min`, `from 2024-02-07 14:45:00 to 2024-02-08 14:45:00`) use the user timezone. This distinction applies solely to the time period covered in the query. The results will always be displayed in the timezone of the user. ### **Example:** Let's consider how this would work in a real-world scenario. Suppose two Nexthink users query the data using the Nexthink platform set to Eastern Time (ET). * The first user operates in the same timezone as the Nexthink platform. The current time for them is November 11, 05:26:15. * The second user operates in the Central European Time (CET) zone. The current time for them is November 11, 11:26:15. In such a case, time-related queries made by the second Nexthink user will be translated into the corresponding timeframes, considering the timezone differences between CET and ET. This ensures accurate data retrieval and analytics, regardless of geographical location or timezone.
Timeframe selectionNexthink user in the Eastern Time (ET) zone - the same zone as the Nexthink platform:Nexthink user in the Central European Time (CET) zone:Timeframe
past 15minNov 11, 05:15:00 AM
– 05:30:00 AM ET​		Nov 11, 11:15:00 AM
– 11:30:00 AM CET		Nexthink user in the Central European Time (CET) zone
past 2hNov 11, 04:00:00 AM
– 06:00:00 AM ET​		Nov 11, 10:00:00 AM
– 12:00:00 PM CET
past 24hNov 10, 06:00:00 AM
– Nov 11 06:00:00 AM ET​		Nov 10, 12:00:00 PM
– Nov 11, 12:00:00 PM CET
from 2021-11-11 00:00:00
to 2021-11-11 12:00:00		from 2021-11-11 12:00:00 AM
to 2021-11-11 12:00:00 PM		from 2021-11-11 12:00:00 AM
to 2021-11-11 12:00:00 PM
past 1dNov 11, 12:00:00 AM
– Nov 12, 12:00:00 AM ET		Nov 11, 06:00:00
– Nov 12, 06:00:00 CET
on Nov 10, 2021Nov 10, 12:00:00 AM
– Nov 11, 12:00:00 AM ET​		Nov 10, 06:00:00
– Nov 11, 06:00:00 CET
--- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://docs.nexthink.com/platform/understanding-key-data-platform-concepts/nexthink-query-language-nql/nql-syntax-overview/nql-time-selection.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.