# Software Metering NQL examples

{% hint style="warning" %}
Users and devices can be removed from Nexthink Infinity. When this occurs, software metering data may remain without an associated user or device. Refer to the [Understanding Key Data Platform Concepts – Data Resolution and Retention](https://docs.nexthink.com/platform/getting-started/understanding-key-data-platform-concepts/data-resolution-and-retention#dataresolutionandretention-retentionperdatacategory) documentation for more information about data retention for Inventory objects.
{% endhint %}

## Querying the software metering data <a href="#softwaremeteringnqlexamples-queryingthesoftwaremeteringdata" id="softwaremeteringnqlexamples-queryingthesoftwaremeteringdata"></a>

Use Nexthink Query Language (NQL) in the [Investigations](/platform/user-guide/investigations.md) module to access software metering data and other relevant information.

## NQL data structure <a href="#softwaremeteringnqlexamples-nqldatastructure" id="softwaremeteringnqlexamples-nqldatastructure"></a>

The `software_metering.events` table contains software usage data. Each event has a resolution of 1 week. The retention of this data is 90 days.

## Timeframe alignment between Software Metering and other tables in NQL

When using NQL to query Software Metering data, be aware that these events are grouped into 7-day periods. This means each event spans a full week, not a single day. The start of every `software_metering.event` is always Monday at 00:00 UTC.

**Why it matters**

Because of this weekly grouping, **mismatched timeframes** can lead to:

* Missing data,
* Including partial results, or
* Incorrect comparisons—especially when combining with events such as `execution.events`, which use finer time granularity.

For example, these two queries will return the same results because both start retrieving data on a Monday at 00:00 UTC:

```nql
software_metering.events from 2025-08-04 00:00:00 to 2025-08-08 10:00:00
| where application.name == "Firefox"
| summarize number_of_users = user.count()
```

```nql
execution.events from 2025-08-04 00:00:00 to 2025-08-08 10:00:00
| where application.name == "Firefox"
| summarize number_of_users = user.count()
```

### Examples of NQL queries <a href="#softwaremeteringnqlexamples-examplesofnqlqueries" id="softwaremeteringnqlexamples-examplesofnqlqueries"></a>

<details>

<summary>Get a list of users underusing the desktop-based software, for example, using it less than two hours in the last 90d.</summary>

{% code lineNumbers="true" %}

```
Users during past 30d
| with software_metering.events during past 90d
| where meter_configuration.name == "*office*"
| compute desktop_app_usage = desktop_focus_time.sum()
| where desktop_app_usage != NULL and desktop_app_usage < 2h
| list user.name, desktop_app_usage
```

{% endcode %}

</details>

<details>

<summary>Get a list of devices with an application package installed but no usage of the application in the last 90d.</summary>

{% code lineNumbers="true" %}

```
Devices during past 30d
| include software_metering.events during past 90d
| where meter_configuration.name  == "visio"
| compute desktop_app_usage = desktop_focus_time.sum()
| include package.installed_packages
| where Package.name == "*visio*"
| where package.type == program
| compute packages_installed = device.count()
| where desktop_app_usage == NULL and packages_installed > 0
| list device.name, desktop_app_usage, packages_installed
```

{% endcode %}

</details>

<details>

<summary>If web usage time is not enabled: get a list of users who have accessed the web-based software at least once.</summary>

{% code lineNumbers="true" %}

```
users during past 30d
| with software_metering.events during past 90d
| where meter_configuration.name == "*miro*"
| where web_is_used == TRUE
| compute event_where_web_was_used = count()
| where event_where_web_was_used > 0
| summarize users_using_application = count()
```

{% endcode %}

</details>


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.nexthink.com/platform/user-guide/software-metering/software-metering-nql-examples.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.