NQL editor

The NQL editor offers a web-based user interface allowing you to write and execute investigations using Nexthink Query Language (NQL).

The embedded syntax editor allows you to adjust existing queries or create new ones from scratch. The results help you investigate issues and problems faced by employees in your organization.

Querying data using the NQL editor

Select Investigations from the main menu to create or edit an existing investigation. The Visual editor tab opens by default.
Switch to the NQL editor mode and start writing your NQL query.
- Refer to the Nexthink Query Language (NQL) documentation page for more information about NQL syntax and capabilities.
- Access the NQL data model documentation page using the question mark icon in the bottom-right corner of the NQL editor.

Select Run to execute the query and generate results in a Results tab.
If needed, use the following buttons available in NQL Editor, next to Run:
- Copy query
- Paste from clipboard
- Clear query

Querying connection events for Network view

From the Investigations page:

Switch to the NQL editor mode.
Run an NQL query to investigate connection.events to enable the Network tab.
Open the Network tab for Network view visualization.

See the following connection.events query example:

connection.events during past 7d
| summarize no_of_binaries = binary.count(), no_of_devices = device.count(), no_of_users = user.count(), no_of_applications = application.application.name.count(), no_of_network_applications = application.network_application.name.count()
| list no_of_binaries, no_of_devices, no_of_users, no_of_applications, no_of_network_applications

Refer to the Network view documentation to learn how to identify and troubleshoot network-related issues.

Querying chart visualizations of investigation results

From the Investigations page:

Switch to the NQL editor mode.
Run a NQL query compatible with line charts and bar charts NQL structure.
Click the Toggle to chart view button in the top-right corner of the investigations result table for data visualization.

See the bar chat query example below.

Charts created from queries in the NQL editor may not be supported by the Visual editor.

devices during past 7d
| summarize no_of_devices = count() by device.hardware.model
| list no_of_devices, device.hardware.model