Custom trends management
Last updated
Last updated
Custom trends extend the standard Nexthink data model, allowing you to save a daily snapshot of the existing data and observe its evolution over time, for up to 13 months.
You can configure up to 200 custom trends.
Nexthink offers a set of preconfigured custom trends that you can manually install from Nexthink Library. Go to the Nexthink Library module within your Nexthink instance to install, manage, and update predefined custom trends.
Refer to Nexthink Library documentation for more information.
Creating a custom trend from scratch lets you view desired data according to your needs and use cases.
Refer to Creating a custom trend for more information.
Select Administration from the main menu.
Click on Custom trends in the Content management section of the navigation panel.
The custom trends administration page displays the list of custom trends that have already been defined.
View the total number of custom trends located on the top-left side of the table.
Search for the custom trend by name using a search box located on the top-right side of the page to narrow down the listed results.
Hover over a three vertical dot icon of the custom trend to reveal the action menu with the following options:
Edit: View details of the custom trend configuration and change the name, description and the NQL query.
Edit tags: Add or remove the associated tags.
Export: Download and save the custom trend in JSON format.
Delete: Remove the custom trend.
Click on Import in the top-right corner of the page.
Choose the JSON file of the custom trend you want to import from your device.
All imported items will be categorized as custom content.
Tagging allows you to efficiently organize custom trends, facilitating quick and easy navigation through your data. Filter the table by typing or selecting Tags from the right-side panel.
To assign, remove or edit tags:
Hover over a custom trend to display the action menu on the right side of the table.
Click Edit tags to open the Tags pop-up.
Type in a new tag name or choose an existing one to add it to the custom trend.
Open the tag’s action menu to remove the tag from the custom trend or change the tag color. Deleting a tag only removes it from the associated custom trend.
To create a new custom trend:
Click on the New custom trend button in the top-right corner of the Custom trend page.
Enter the Name and Description on the custom trend configuration page.
If needed, adjust the Query ID, the unique identifier for NQL.
Enter an optional Description to help others understand the meaning and purpose of this trend data.
Write the NQL query the Nexthink platform executes during the daily snapshot evaluation.
Remember that once you have saved the custom trend, you can no longer change the NQL query and the Query ID value.
While writing the query, follow the rules below:
The query must target the devices
namespace.
The time interval allowed for devices
is during the past 1d
. Omit this time interval to target all devices registered in the system.
The query must have a maximum of two include
clauses and two compute
clauses.
The only time interval allowed after the include
clauses for event collections is during the past 1d
. You can include object collections without specifying any time interval.
Nexthink does not allow the where
clause when applied to the result of a compute
clause.
The query cannot include personally identifiable information (PII), such as the device name, employee email address, and others.
The query must end with a list
clause including a maximum of two metrics (numbers) and a maximum of 5 properties (strings, enums or booleans).
The system does not allow the as()
, sort
, limit
, summarize
, countif()
, sumif()
, or with
keywords.
The system includes by default some device properties when evaluating the daily snapshots and stores them as part of the context of the device. These include:
operating system platform
operating system name
location (country, state, location type)
organization (entity, custom organization)
In the definition of the custom trend you can specify the set of devices based on their activity.
To save snapshots with all the devices registered in the system (which are all the devices that were active in the last 30 days, see Data resolution and retention), omit the time selection for the devices
table in the definition of the custom trend.
To save snapshots with the devices that were active during the day the snapshot was taken add during past 1d
after devices
in the definition of the custom trend.
When you haven’t specified the timeframe for the devices, you may expect slight discrepancies in the results when comparing trend data with operational data from the same period.
Select the Data retention checkbox to acknowledge that this trend data will be saved in the system for a period of 13 months.
Click on the Save button to save your new custom trend.
After saving a custom trend, you can query the new trend data with NQL. Initially, the query only returns data from the three days prior to the day the custom trend definition was saved. This allows you to verify if the custom trend you configured returns the data in the expected format.
The initial data computed from the three previous days, will only include the device context information from the current day.
The system saves additional snapshots nightly. Snapshots include events occurring from midnight of the preceding day to midnight of the computation day, in the customer timezone.
Below is an example of an NQL query used in a custom trend definition:
Saving metrics and properties in the trend using the | list
clause creates a new field within the custom trend table. The system constructs the new field name by following the rules below:
In the example above, using hardware.manufacturer
field from the devices
table in a | list
clause of a custom trend definition creates a new field named hardware_manufacturer
in the custom trend table.
The custom trends table looks as follows:
You can query custom trend data in Investigations or create a dashboard widget to monitor the trend on a timeline. The syntax to retrieve custom trend data is as follows:
When configuring a widget, use the NQL ID of an existing custom trend to visually represent the evolution over time of a specific metric.
Trend tables are associated with devices
table. When retrieving trend data, you can utilize these association to include the device properties in your query. However, these properties will be only available as long as they are stored in the original table. Refer to Data resolution and retention page for more information.
While custom trend fields, such as hardware_manufacturer
, have a retention spanning up to 13 months, the properties of the associated devices are available as long as the device is registered in the system. If you delete or anonymize the device or if the device has been inactive for over 30 days, the query will return "-" since the device properties are not saved directly in the trend. This does not apply to the device context information that custom trends save by default which is also retained for 13 months (see Writing NQL queries for custom trends on this page).
To effectively utilize custom trends, it is essential to understand that plotting trend data involves a two-step process: Custom trend configuration and dashboard design (Refer to Managing Live Dashboards for detailed instructions).
It is important to note that you do not necessarily need to create a custom trend for every metric you wish to track. A single custom trend serves as an extension to the NQL data model, allowing you to query long-term data with various combinations of metrics and aggregations.
Consider the following recommendations regarding Custom trends configuration and retrieval:
Snapshot computations may fail for various reasons—for example, if the custom trend NQL query definition is incorrect due to changes in the dynamic data model, such as custom fields or organization structure, or if the system experienced a temporary failure. Failures may result in incomplete custom trend data. Understanding these failures is crucial for quickly resolving issues and creating visibility into possible problems with the data displayed on the dashboards.
The system saves each custom trend computation with details such as computation time, status and custom trend NQL ID in the platform.custom_trends_logs
table. Use the following NQL query to investigate the cause of specific custom trend computation failures:
Nexthink recommends configuring a monitor that detects all custom trend failures to help you stay informed and react quickly. Use the following monitor NQL query and settings:
Refer to the Creating custom monitors page for more information.
Nexthink uses a mechanism to prevent custom trend data gaps caused by unforeseen technical breakdowns. If the system fails to compute and save the snapshot from a particular day, during the next daily computation, it attempts to compute the missing data before computing the current snapshot. The mechanism can restore data from up to the past three days, giving you additional time to address the issue and maintain trend continuity on your dashboard.
The data computed from the previous days, will only include the device context information from the current day.
You can create custom trends in the Nexthink web interface if your user role has the Manage all custom trend data permission enabled.
You can access the platform.custom_trends_logs
table if your user role has the View platform logs in NQL permission enabled.
Refer to the Roles documentation for more information.
Field used in custom trend definition query | Field name in custom trend table | Rule description |
---|---|---|
Bucket start | … | Context | Metric | Property |
---|---|---|---|---|