Spark NQL capabilities

Use Nexthink Query Language (NQL) in the Investigations module to access Spark conversations data.

The system stores each conversation in the agent.conversations NQL table. Refer to NQL data model > Namespace agent for more details on available fields.

The following are examples of common NQL queries:

Key Spark KPIs

Retrieve key Spark KPIs from the last 30 days, such as the number of active users, total number of conversations and the number of conversations that are currently active.

agent.conversations during past 30d
| summarize active_users = user.count(), total_conversations = conversation_id.count(), active_conversations = conversation_id.countif((state == in_progress or state == null))

Conversation number and duration per device

Retrieve the number of conversations and avarage conversation duration per device.

devices during past 30d
| include agent.conversations during past 30d
| where agent.conversations.outcome in [resolved, escalated]
| compute number_of_conversations_ = conversations.number_of_conversations.sum(), average_resolution_time = agent.conversations.conversation_duration.avg()
| where number_of_conversations_ != 0
| where average_resolution_time != 0
| list device.name, device.entity, device.hardware.model, device.hardware.type, device.operating_system.name, number_of_conversations_, average_resolution_time
| sort number_of_conversations_ desc

Resolved conversations by resolution reason

Retrieve the number of resolved conversations in the last 7 days broken down by resolution reason.

agent.conversations during past 7d
| where outcome == resolved
| summarize number_of_conversations_by_reason = count() by reason