Getting started with Investigations
Last updated
Last updated
The Investigations module allows you to delve into specific technical metrics to give you a better understanding of the overall digital experience of your employees.
To access an investigation, choose one of the following options:
Select Investigations from the main menu.
Open an existing Shared or Private investigation grouped by investigation tags, and listed within the main menu.
Click the New button within the main menu to create an investigation.
Select Investigations > Manage investigations from the main menu.
Open an existing investigation or create a New investigation.
Refer to the Managing Investigations documentation for tagging, importing, sharing, exporting and managing investigations.
Nexthink offers a set of preconfigured investigations that you can manually install from Nexthink Library. Go to the Nexthink Library module within your Nexthink instance to install, manage and update predefined investigations.
Refer to the Nexthink Library documentation for more information.
Creating an investigation from scratch allows you to monitor specific types of data and metrics according to your own needs and use cases.
Refer to the Creating investigations documentation for more information.
Create a new investigation following one of these options:
Click the New button in the top-right corner of the Investigations main menu—left panel.
Click the New investigation button in the top-right corner of the Investigations > Managing investigations page.
Click on the New Investigation button in the top-right corner of an existing investigation page—which opens a new investigation tab.
After creating an investigation, build your investigation query using Visual Editor or NQL editor from the investigation page.
Alternatively, with the support of Nexthink Assist, you may write and build investigation queries without any prior knowledge of NQL.
The system displays the investigation results as a table.
By default, the maximum number of query results is 10,000 rows displayed in the Nexthink web interface. The export to CSV feature returns up to 1,000,000 rows.
Refer to Analizing investigations for more information.
Select the timeframe of the displayed data using the active during drop-down in the Visual editor or the during past keyword in the NQL editor.
The system limits the results to events within the selected time period.
The system limits the results to the active inventory within the selected timeframe. This means the system outputs objects detected during the selected timeframe.
The selected timeframe automatically applies across metric columns computed for a given object.
The source collection and computed metric have the same timeframe.
Refer to the Roles documentation for a detailed description of Permissions, View domain options and Data privacy granularity settings.
To enable proper permissions for Investigations, as an administrator:
Select Administration > Roles from the main navigation panel.
Create a New Role or edit an existing one by hovering over it.
In the Permissions section, scroll down to the Investigations section to enable appropriate permissions for the role.
The table below shows what users with full and limited View domain access can do, assuming the necessary permissions are enabled.
Create private investigations; use global search
Manage shared investigations
Share private investigations
View shared investigations
RELATED TOPICS
