NQL where

A where clause allows you to add conditions to your query to filter the results.

Syntax

...
| where <field name> <comparison operator> <field value>

Examples

Select the devices running the Windows operating system.

devices during past 7d
| where operating_system.platform == Windows
NamePlatform

nxt-gcarlisa

Windows

nxt-wmirjam

Windows

Select the devices not running the Windows operating system.

devices during past 7d
| where operating_system.platform != Windows
| list name, operating_system.platform
NamePlatform

nxt-jdoe

macOS

nxt-vlatona

macOS

Select the users whose name contains “jo”.

users during past 7d
| where username == "*jo*"
Name

John Fisher

John Doe

Using multiple conditions

Use multiple filters separated by and or or operators to apply more complex conditions. The conditions in the filter are grouped together to preserve the order of precedence. When you put where clauses on separate lines, the result is the same as if you created one where clause with multiple and conditions.

The following queries provide the exact same results.

devices during past 7d
| where device.entity == "Lausanne" and device.hardware.type == laptop
devices during past 7d
| where device.entity == "Lausanne" 
| where device.hardware.type == laptop

Last updated

#451: 2024.8-Overview of integration DOC

Change request updated