> For the complete documentation index, see [llms.txt](https://docs.nexthink.com/platform/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.nexthink.com/platform/user-guide/software-metering/software-metering-nql-examples.md).

# Software Metering NQL examples

{% hint style="warning" %}
Users and devices can be removed from Nexthink Infinity. When this occurs, software metering data may remain without an associated user or device. Refer to the [Understanding Key Data Platform Concepts – Data Resolution and Retention](https://docs.nexthink.com/platform/getting-started/understanding-key-data-platform-concepts/data-resolution-and-retention#dataresolutionandretention-retentionperdatacategory) documentation for more information about data retention for Inventory objects.
{% endhint %}

## Querying the software metering data <a href="#softwaremeteringnqlexamples-queryingthesoftwaremeteringdata" id="softwaremeteringnqlexamples-queryingthesoftwaremeteringdata"></a>

Use Nexthink Query Language (NQL) in the [Investigations](/platform/user-guide/investigations.md) module to access software metering data and other relevant information.

## NQL data structure <a href="#softwaremeteringnqlexamples-nqldatastructure" id="softwaremeteringnqlexamples-nqldatastructure"></a>

The `software_metering.events` table contains software usage data. Each event has a resolution of 1 week. The retention of this data is 90 days.

## Timeframe alignment between Software Metering and other tables in NQL

When using NQL to query Software Metering data, be aware that these events are grouped into 7-day periods. This means each event spans a full week, not a single day. The start of every `software_metering.event` is always Monday at 00:00 UTC.

**Why it matters**

Because of this weekly grouping, **mismatched timeframes** can lead to:

* Missing data,
* Including partial results, or
* Incorrect comparisons—especially when combining with events such as `execution.events`, which use finer time granularity.

For example, these two queries will return the same results because both start retrieving data on a Monday at 00:00 UTC:

```nql
software_metering.events from 2025-08-04 00:00:00 to 2025-08-08 10:00:00
| where application.name == "Firefox"
| summarize number_of_users = user.count()
```

```nql
execution.events from 2025-08-04 00:00:00 to 2025-08-08 10:00:00
| where application.name == "Firefox"
| summarize number_of_users = user.count()
```

### Examples of NQL queries <a href="#softwaremeteringnqlexamples-examplesofnqlqueries" id="softwaremeteringnqlexamples-examplesofnqlqueries"></a>

<details>

<summary>Get a list of users underusing the desktop-based software, for example, using it less than two hours in the last 90d.</summary>

{% code lineNumbers="true" %}

```
Users during past 30d
| with software_metering.events during past 90d
| where meter_configuration.name == "*office*"
| compute desktop_app_usage = desktop_focus_time.sum()
| where desktop_app_usage != NULL and desktop_app_usage < 2h
| list user.name, desktop_app_usage
```

{% endcode %}

</details>

<details>

<summary>Get a list of devices with an application package installed but no usage of the application in the last 90d.</summary>

{% code lineNumbers="true" %}

```
Devices during past 30d
| include software_metering.events during past 90d
| where meter_configuration.name  == "visio"
| compute desktop_app_usage = desktop_focus_time.sum()
| include package.installed_packages
| where Package.name == "*visio*"
| where package.type == program
| compute packages_installed = device.count()
| where desktop_app_usage == NULL and packages_installed > 0
| list device.name, desktop_app_usage, packages_installed
```

{% endcode %}

</details>

<details>

<summary>If web usage time is not enabled: get a list of users who have accessed the web-based software at least once.</summary>

{% code lineNumbers="true" %}

```
users during past 30d
| with software_metering.events during past 90d
| where meter_configuration.name == "*miro*"
| where web_is_used == TRUE
| compute event_where_web_was_used = count()
| where event_where_web_was_used > 0
| summarize users_using_application = count()
```

{% endcode %}

</details>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.nexthink.com/platform/user-guide/software-metering/software-metering-nql-examples.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.