NQL editor
Last updated
Last updated
The NQL editor is the feature offering a web-based user interface allowing you to write and execute investigations using the Nexthink Query Language (NQL).
The embedded syntax editor allows for adjusting of existing queries or creating new ones from scratch. The results help you to investigate issues and problems faced by the employees of your organization.
Select Investigations from the main menu to create or edit an existing investigation.
The Visual editor tab opens by default.
Switch to the NQL editor tab and start writing your NQL query.
Running NQL queries to investigate connection.events enables the Network tab. Refer to the Network view documentation to learn how to troubleshoot network-related issues using the network view visualization.
If needed, refer to the NQL data model documentation.
Hover over a specific cell value in the investigation results table, to open the action menu containing different options depending on the field:
Drill down to … opens an Investigation page with the NQL query listing the results specific to the row of the selected cell value under the field column of interest. See the image below.
The Drill down to... option is available for field metric values.
Copy value or Copy raw value. Remember, the system shortens large numbers with appropriate suffixes. Hover over a metric to see the raw number.
Use the contextual action menu only for inventory objects—users, devices and binaries—to:
Open binary profiling, Open user overview or Open device view, depending on the case.
Diagnose for diagnostics dashboards.
Retrieve all pre-filled investigation queries in the inventory-object context.
Additionally, when you select entire rows by ticking the checkboxes on the left of the table, the system displays an action bar at the bottom of the Nexthink web interface.
Depending on the selected cell item, the action bar includes the action menu options listed above, plus the possibility to Execute action, Edit or Launch campaigns.
Click on the Save as button in the top-right corner of the Investigations page to save an investigation.
Saved investigations appear on the Manage Investigations page and in the navigation panel for the Investigations module.
If you are editing an existing investigation, you can:
Click Save to save the changes.
Click Save as to save the investigation under a different name.
Click on the action menu in the top-right corner of the Investigations page to:
Share an investigation with groups of users based on their user role, and collaborate with them on an investigation. Grant permissions to other users to view or edit the investigation. Refer to the Sharing an investigation section of the Manage Investigations documentation for more information.
Copy link to an investigation and share it with other Nexthink users. Copy link shares the query text in the URL and is always treated as a new investigation for the user you send the link to.
Export results of the data returned by the investigation in a CSV file.
By default, the Visual editor limits the maximum number of query results to 10,000 rows on the webpage. The export to CSV feature returns up to 1,000,000 rows.
Ticking the Formatted data checkbox from the Export results in the CSV pop-up, allows you to format Raw data. See the table below for more details.
Rename or Delete an existing investigation using the same action menu from the Investigations page.
This table displays the differences between exporting Raw data and Formatted data for most data types.
| Data type | Example of Raw data | Example of Formatted data |
|---|---|---|
bool/bool | 0 1 | No Yes |
bytes/bytes | 5109928912799 | 4.65 TB |
jsontype[]/device/antivirus | Cortex XDR™ Advanced Endpoint Protection; Microsoft Defender Antivirus | |
jsontype[]/device/cpu | Apple M1 Pro | |
jsontype[]/device/disk | APPLE SSD AP1024R | |
jsontype[]/device/firewall | Windows Firewall | |
jsontype[]/device/gpu | NVIDIA Quadro P520; Intel UHD Graphics | |
jsontype[]/device/local_admin | Kanopy@KAN-HDKTYD3; localadmin@KAN-HDKTYD3 | |
jsontype[]/device/monitor | DELL; Wide viewing angle & High density FlexView Display 1920x1080 | |
jsontype[]/device/volume | disk0s1; disk0s2; disk0s3 | |
numeric/duration | 900 | 15min |
numeric/float | 4997.0634765625 | 5k |
numeric/long | 4111 | 4111 |
numeric/integer | 3462 | 3.46k |
numeric/numeric | 65287 | 65287 |
string/bytes | xdt7cS8oDDrk9zGtfV6hcQ== | xdt7cS8oDDrk9zGtfV6hcQ== |
string/datetime | 2024-02-23 17:45:00 | 23/02/2024 17:45:00 |
string/ipAddress | 192.168.1.23 | 192.168.1.23 |
string/ipAddressArray | ::ffff:62.2.17.60,::ffff:62.2.24.162 | ::ffff:62.2.17.60::ffff:62.2.24.162 |
string/jsonArrayString | Appinfo, NaturalAuthentication, TokenBroker, UserManager, XblGameSave, shpamsvc | |
string/string | NXT-FVFWW2RZHV2H | NXT-FVFWW2RZHV2H |
string/uuid | a8572a66-e312-4bda-9515-9b9666555aa4 | a8572a66-e312-4bda-9515-9b9666555aa4 |
string/version | [10,0,22000,653] | 10.0.22000.653 |
RELATED TOPIC
