Getting started with Investigations

The Investigations module allows you to delve into specific technical metrics to give you a better understanding of the overall digital experience of your employees.

Accessing Investigations

To access an investigation, choose one of the following options:

Select Investigations from the main menu.
- Open an existing Shared or Private investigation grouped by investigation tags, and listed within the main menu.
- Click the New button within the main menu to create an investigation.
Select Investigations > Manage investigations from the main menu.
- Open an existing investigation or create a New investigation.

Refer to the Managing Investigations documentation for tagging, importing, sharing, exporting and managing investigations.

Accessing Investigations from main menu.

Built-in investigations

Investigations installed from Nexthink Library

Nexthink offers a set of preconfigured investigations that you can manually install from Nexthink Library. Customize, copy and leverage these built-in library investigations to accelerate the creation and adoption of effective investigations.

Refer to the Nexthink Library documentation for more information.

Install the Nexthink Library Investigations starter pack with predefined investigations to quickly gain insights on common issues without manually writing NQL queries, or using Nexthink Assist or Visual editor to query data.

Custom investigations

Creating an investigation from scratch allows you to monitor specific types of data and metrics according to your own needs and use cases.

Refer to the Creating investigations documentation for more information.

Creating investigations

Create a new investigation following one of these options:

Click the New button in the top-right corner of the Investigations main menu—left panel.
Click the New investigation button in the top-right corner of the Investigations > Managing investigations page.
Click on the New Investigation button in the top-right corner of an existing investigation page—which opens a new investigation tab.

After creating an investigation, build your investigation query using Visual Editor or NQL editor from the investigation page.

Alternatively, with the support of Nexthink Assist, you may build investigation queries without any prior knowledge of Visual editor or NQL.

Understanding investigation results

The system displays the investigation results as a table.

By default, the maximum number of query results is 10,000 rows displayed in the Nexthink web interface. The export to CSV feature returns up to 1,000,000 rows.

Refer to Analizing investigations for more information.

Investigation table with 23k rows-results.

Investigation timeframe

Select the timeframe of the displayed data using the active during drop-down in the Visual editor or the during past keyword in the NQL editor.

Timeframe for events

The system limits the results to events within the selected time period.

Timeframe for objects

The system limits the results to the active inventory within the selected timeframe. This means the system outputs objects detected during the selected timeframe.

The selected timeframe automatically applies across metric columns computed for a given object.

The source collection and computed metric have the same timeframe.

Granting permissions for Investigations

Refer to the Roles documentation for a detailed description of Permissions, View domain options and Data privacy granularity settings.

To enable proper permissions for Investigations, as an administrator:

Select Administration > Roles from the main navigation panel.
Create a New Role or edit an existing one by hovering over it.
In the Permissions section, scroll down to the Investigations section to enable appropriate permissions for the role.

View domain impact on Investigations permissions

The table below shows what users with full and limited View domain access can do, assuming the necessary permissions are enabled.

Permission

Full access

Limited access

Create private investigations; use global search

Manage shared investigations

Share private investigations

View Nexthink Assist (you explicitly consent to our updated data processors)

View shared investigations