Getting started with Investigations
Last updated
Last updated
The Investigations module allows you to delve into specific technical metrics to give you a better understanding of the overall digital experience of your employees.
To access an investigation, choose one of the following options:
Select Investigations from the main menu.
Open an existing Shared or Private investigation grouped by investigation tags, and listed within the main menu.
Click the New button within the main menu to create an investigation.
Select Investigations > Manage investigations from the main menu.
Open an existing investigation or create a New investigation.
Refer to the Managing Investigations documentation for tagging, importing, sharing, exporting and managing investigations.
Nexthink offers a set of preconfigured investigations that you can manually install from Nexthink Library. Go to the Nexthink Library module within your Nexthink instance to install, manage and update predefined investigations.
Refer to the Nexthink Library documentation for more information.
Creating an investigation from scratch allows you to monitor specific types of data and metrics according to your own needs and use cases.
Refer to the Creating a new investigation documentation for more information.
Click on the New investigation button in the top-right corner of the page:
The system takes you to the Visual editor mode of the Investigations page where you can construct your query with a few simple clicks, using a graphical tool.
Alternatively, switch to the NQL editor to build and write powerful queries by hand or create a new investigation without any prior knowledge of NQL with the support of Nexthink Assist. Refer to the Query data with Assist documentation.
Refer to Creating Investigations for more information.
The system displays the investigation results as a table.
By default, the maximum number of query results is 10,000 rows displayed in the Nexthink web interface.
The export to CSV feature returns up to 1,000,000 rows.
Select the timeframe of the displayed data using the active during drop-down in the Visual editor or the during past keyword in the NQL editor.
The system limits the results to events within the selected time period.
The system limits the results to the active inventory within the selected timeframe. This means the system outputs objects detected during the selected timeframe.
The selected timeframe automatically applies across metric columns computed for a given object.
The source collection and computed metric have the same timeframe.
Refer to the Roles documentation for a detailed description of Permissions, View domain options and Data privacy granularity settings.
To enable proper permissions for Investigations, as an administrator:
Select Administration > Roles from the main navigation panel.
Create a New Role or edit an existing one by hovering over it.
In the Permissions section, scroll down to the Investigations section to enable appropriate permissions for the role.
The table below shows what users with full and limited View domain access can do, assuming the necessary permissions are enabled.
Create private investigations; use global search
Manage shared investigations
Share private investigations
View shared investigations
RELATED TOPICS
