Getting started with Investigations
The Investigations module allows you to delve into specific technical metrics to give you a better understanding of the overall digital experience of your employees.
Accessing Investigations
To access an investigation, choose one of the following options:
Select Investigations from the main menu.
Open an existing Shared or Private investigation grouped by investigation tags, and listed within the main menu.
Click the New button within the main menu to create an investigation.
Select Investigations > Manage investigations from the main menu.
Open an existing investigation or create a New investigation.
Refer to the Managing Investigations documentation for tagging, importing, sharing, exporting and managing investigations.
Built-in investigations
Investigations installed from Nexthink Library
Nexthink offers a set of preconfigured investigations that you can manually install from Nexthink Library. Go to the Nexthink Library module within your Nexthink instance to install, manage and update predefined investigations.
Refer to the Nexthink Library documentation for more information.
Private investigations
Creating an investigation from scratch allows you to monitor specific types of data and metrics according to your own needs and use cases.
Refer to the Creating a new investigation documentation for more information.
Creating a new investigation
Click on the New investigation button in the top-right corner of the page:
The system takes you to the Visual editor mode of the Investigations page where you can construct your query with a few simple clicks, using a graphical tool.
Alternatively, switch to the NQL editor to build and write powerful queries by hand or create a new investigation without any prior knowledge of NQL with the support of Nexthink Assist. Refer to the Query data with Assist documentation.
Refer to Creating Investigations for more information.
Understanding investigation results
The system displays the investigation results as a table.
By default, the maximum number of query results is 10,000 rows displayed in the Nexthink web interface.
The export to CSV feature returns up to 1,000,000 rows.
Investigation timeframe
Select the timeframe of the displayed data using the active during drop-down in the Visual editor or the during past keyword in the NQL editor.
Timeframe for events
The system limits the results to events within the selected time period.
Timeframe for objects
The system limits the results to the active inventory within the selected timeframe. This means the system outputs objects detected during the selected timeframe.
The selected timeframe automatically applies across metric columns computed for a given object.
The source collection and computed metric have the same timeframe.
Granting permissions for Investigations
Refer to the Roles documentation for a detailed description of Permissions, View domain options and Data privacy granularity settings.
To enable proper permissions for Investigations, as an administrator:
Select Administration > Roles from the main navigation panel.
Create a New Role or edit an existing one by hovering over it.
In the Permissions section, scroll down to the Investigations section to enable appropriate permissions for the role.
View domain impact on Investigations permissions
The table below shows what users with full and limited View domain access can do, assuming the necessary permissions are enabled.
| Permission | Full access | Limited access |
|---|---|---|
Create private investigations; use global search | ||
Manage shared investigations | ||
Share private investigations | ||
View shared investigations |
RELATED TOPICS
Last updated