Workflows NQL examples

The system stores the executions of workflows, which you can then query with NQL. The following are examples of common NQL queries:

All workflow executions in the past 7 days

This query returns all workflow executions triggered in the past 7 days including details of the current status and any message returned by Nexthink.

workflow.executions during past 7d
|list request_id, request_time, workflow.name,device.name, status, status_details
|sort request_time desc

All workflow executions in the past 7 days with outcomes

This query returns all workflow executions triggered in the past 7 days including information about the outcome of the workflow.

workflow.executions during past 7d
|list request_id, request_time, workflow.name,device.name, outcome, outcome_details
|sort request_time desc

All workflow executions of a specific workflow

This query returns all of the recorded executions for a specified remote action. Replace the "Name of workflow" in the query below with the name of the workflow you want to query.

workflow.executions
|where workflow.name == "Name of workflow"
|list request_id, request_time, workflow.name, status, status_details
|sort request_time desc 

Alternatively, you can use the nql_id of the workflow for a more precise search as shown below.

workflow.executions
|where workflow.nql_id  == "#service_restart_and_repair"
|list request_id, request_time, workflow.name, status, status_details
|sort request_time desc     

All workflow executions targeted at a specific device

This query returns all of the workflow executions where a specific device was the target.

workflow.executions
|where device.name == "devicehostname"
|list request_time, workflow.name,device.name, status
|sort request_time desc     

All workflow execution failures in the past 24 hours

This query returns a list of workflow executions that have failed in the past 24 hours, including the last known status message from the execution.

workflow.executions during past 24h
|where status == failure 
|list request_time, workflow.name,device.name, status, status_details
|sort request_time desc  

All workflow execution failures for a specific workflow including inputs

This query returns all of the workflow executions including their inputs in a single string. This can be helpful for debugging workflow failures.

workflow.executions during past 7d
|where status == failure and workflow.name == "Name of workflow"
|list request_time, workflow.name, inputs, status, status_details
|sort request_time desc