Campaigns NQL examples

This list of NQL query examples is designed to help you select the users relevant to your campaign. Go through the queries below, copy the query that is most similar to your use case, and adjust it accordingly.

Example queries to target users in scheduled campaigns

Retrieve all users from a specific city.

users
| where ad.city == "Lausanne"

Retrieve users with installed Collector (xTray) that has been running on their device in the last 24 hours.

users
| include execution.events during past 24h
| where binary.name == "nxtray*"
| compute c1 = binary.name.count()
| where c1 > 0

Retrieve users who have installed MS Teams or Zoom in the last day.

users
| with package.installations during past 1d
| where package.name in [ "MS Teams", "Zoom" ]

Retrieve users from a specific department.

users
| where ad.department == "Finance"

Retrieve the last user of a device that has had 3 system crashes in the past 7 days.

devices past 7d
| with device_performance.system_crashes past 7d
| compute nb_crashes = count()
| where nb_crashes >= 3
| with session.events past 7d
| compute user_sid = user.sid.last()
| list user_sid

Retrieve last users not from the IT department who has a poor battery health.

devices past 7d
| where remote_action.get_battery_status.execution.outputs.BatteryHealth < 0.3
| with session.events past 7d
| where user.ad.department != "*IT*"
| compute user_sid = user.sid.last()
| list user_sid

Schedule a DEX campaign

To randomly select a different sample of employees to continuously collect the sentiment data, set up the query Below. Replace #dex_campaign_name with the NQL ID of the campaign and adjust the limit below set as 50 to specify the number of new users the campaign targets every hour.

Note that you need to:

• Define the trigger Schedule and select Only after the (minimum) number of days you want to have in between responses for each employee

• First, save the campaign at least once before you can use the below NQL query, so that the system is aware that your campaign exists and does not generate a "Table does not exist" error when validating the NQL query.

users
| include campaign.#dex_campaign_name.responses
| compute number_of_requests = count()
| sort number_of_requests asc
| limit 50

Example queries to inspect campaign results

All responses

All responses for the Remote Work Demo campaign, displaying the username, time, state and state_details, all per user.

campaign.responses
| where campaign.name == "Remote Work Demo"
| list user.name, response.time, state, state_details

Summary view

Summary view of the Remote Work Demo campaign responses in terms of campaign trigger_method, time, state, state_details and the number of questions answered, all per user.

campaign.responses
| where campaign.name == "Remote Work Demo"
|list response.trigger_method, user.name, response.time, campaign.response.first_planned, campaign.response.first_targeted, campaign.response.first_displayed, state, state_details, response.number_answered_questions

Count responses per state

Count campaign responses for the Remote Work Demo campaign by user, state and state_details.

campaign.responses
| where campaign.name == "Remote Work Demo"
| summarize cnt = count() by user.name, campaign.response.state, campaign.response.state_details 
| list user.name, cnt, campaign.response.state, campaign.response.state_details   

Count responses for a specific user

Count campaign responses for a specific user by campaign, state and state_details.

campaign.responses
| where user.name == "johndoe@DOMAIN"
| summarize cnt = count() by campaign.name, user.username, campaign.response.state, campaign.response.state_details   
| list user.name, campaign.name, cnt, campaign.response.state, campaign.response.state_details 

Historical states

View the historical states of the campaign responses for the Remote Work Demo campaign.

campaign.responses
| where campaign.name == "Remote Work Demo"
| list response.historical_time, response.historical_state, response.historical_state_details

Count the number of answered or declined responses

Count the number of answered or declined responses of a campaign with the #my_campaign NQL ID.

campaign.#my_campaign.responses
| where state in [answered, declined]
| summarize cnt_responses = request_id.count() by state
| list state, cnt_responses

Count the number of responses by question choice

Count the number of responses by question choice for a single-choice, opinion-scale or NPS question with the vpn_quality question ID.

campaign.#my_campaign.responses
| summarize cnt = request_id.count() by answers.vpn_quality.label, state, state_details
| sort cnt desc

List users who answered a specific campaign

List the users who answered a campaign with the #my_campaign NQL ID.

campaign.#my_campaign.responses
| where state == answered
| list user.name, state, state_details, number_answered_questions

List users who answered with a specific choice

List users who answered with the choice labeled as always for the question with the how_often NQL ID for the campaign with the #my_campaign NQL ID.

campaign.#my_campaign.responses during past 30d
| where answers.how_often.label = "always"
| list user.name, time

List users with their last answer to a sentiment campaign

List all users with their last answers to the question with the sentiment question ID for the sentiment campaign with the #service_sentiment NQL ID (if any).

users
| include campaign.#service_sentiment.responses
| where state == answered
| compute last_satisfaction = answers.sentiment.label.last(), last_answer_on_device = device.name.last()
| list user.name, last_satisfaction, last_answer_on_device

List of users with their last answer to a parametric campaign where the parameter had a specific value

List users with their last answer and comment to the question with the sentiment question ID and the ticket_number parameter associated with the request for the parametric campaign with the #ticket_satisfaction NQL ID, where the parameter value with the issue_type ID is Incident.

users
| with campaign.#ticket_satisfaction.responses
| where state == answered and parameters.issue_type == "Incident"
| compute last_satisfaction = answers.sentiment.label.last(), last_comment = answers.sentiment.comment.last(), ticket_number = parameters.ticket_number.last()
| list ticket_number, last_satisfaction, last_comment, user.name