# NQL syntax overview

## Specifying table <a href="#nqlsyntaxoverview-specifyingtable" id="nqlsyntaxoverview-specifyingtable"></a>

Every NQL query starts with a short statement specifying the table to select data from. The syntax to specify the table is:

`<namespace>.<table>`

For example, listing all records in the events table from the execution namespace translates into the following statement:

{% code overflow="wrap" lineNumbers="true" %}

```
execution.events
```

{% endcode %}

### Syntax shortcuts <a href="#nqlsyntaxoverview-syntaxshortcuts" id="nqlsyntaxoverview-syntaxshortcuts"></a>

Instead of typing the namespace and the table, you can also use the predefined shortcuts. Type the table name only, without a namespace first to retrieve data from the following tables:

| Namespace   | Table        | Shortcut       |
| ----------- | ------------ | -------------- |
| application | applications | `applications` |
| binary      | binaries     | `binaries`     |
| campaign    | campaigns    | `campaigns`    |
| device      | devices      | `devices`      |
| user        | user         | `users`        |

For example, type `devices` instead of `device.devices` to list all the records within the devices table in the device namespace.

{% code overflow="wrap" lineNumbers="true" fullWidth="false" %}

```
devices
```

{% endcode %}

You do not need to specify the table fields included in the results to query data from the table. The system includes default fields that are most relevant to identify the records. For more information about fields contained in specific table, refer to the NQL data model page. Use the [NQL list](/platform/~/changes/Sh4xqs4GDClkDKT9Hvux/user-guide/nexthink-query-language-nql/nql-keywords/nql-list.md) keyword to access other fields in the specific table.

## Specifying time frame <a href="#nqlsyntaxoverview-specifyingtimeframe" id="nqlsyntaxoverview-specifyingtimeframe"></a>

You have the option to filter your results over a specific period of time by putting a time frame selection right after the table name in your NQL statement. Depending on what you need, you can choose from various data selection formats and time precisions. For example you can specify the number of days back:

{% code overflow="wrap" lineNumbers="true" %}

```
execution.crashes during past 7d
```

{% endcode %}

Or specific date:

{% code overflow="wrap" lineNumbers="true" %}

```
execution.crashes on Feb 8, 2024
```

{% endcode %}

You can also use a time selection when querying the following inventory objects: devices, users, binaries. If you specify the time frame for the inventory objects, the system refers to the events behind the object's activity.

For example, the following queries refer to the same set of data.

{% code overflow="wrap" lineNumbers="true" %}

```
devices during past 7
```

{% endcode %}

{% code overflow="wrap" lineNumbers="true" %}

```
devices 
| with device_performance.events during past 7
```

{% endcode %}

For more information regarding the time selection formats refer to the [NQL time selection](/platform/~/changes/Sh4xqs4GDClkDKT9Hvux/user-guide/nexthink-query-language-nql/nql-syntax-overview/nql-time-selection.md)

## Customizing Query Results <a href="#nqlsyntaxoverview-customizingqueryresults" id="nqlsyntaxoverview-customizingqueryresults"></a>

After specifying the table and timeframe, you can further refine your query by providing additional instructions to the system using [keywords](/platform/~/changes/Sh4xqs4GDClkDKT9Hvux/user-guide/nexthink-query-language-nql/nql-keywords.md), [operators](/platform/~/changes/Sh4xqs4GDClkDKT9Hvux/user-guide/nexthink-query-language-nql/nql-operators.md) and [functions](/platform/~/changes/Sh4xqs4GDClkDKT9Hvux/user-guide/nexthink-query-language-nql/nql-functions.md). These refinements allow you to organize, filter or aggregate your results to gather more comprehensive insights.

For example:

1. Filter the results using the `where` clause

   <pre data-overflow="wrap" data-line-numbers><code>binaries during past 24h
   | where binary.name == "dllhost.exe"
   </code></pre>
2. Select specific data to display using the `list` clause

   <pre data-overflow="wrap" data-line-numbers><code>binaries during past 24h
   | where binary.name == "dllhost.exe"
   | list name, version, platform, architecture, size
   </code></pre>
3. Order results using the `sort ... desc` clause

   <pre data-overflow="wrap" data-line-numbers><code>binaries during past 24h
   | where binary.name == "dllhost.exe"
   | list name, version, platform, architecture, size
   | sort size desc
   </code></pre>
4. Set a maximum number of results using the `limit` clause

   <pre data-overflow="wrap" data-line-numbers><code>binaries during past 24h
   | where binary.name == "dllhost.exe"
   | list name, version, platform, architecture, size
   | sort size desc
   | limit 10
   </code></pre>

For more information about specific instructions, refer to the [NQL keywords](/platform/~/changes/Sh4xqs4GDClkDKT9Hvux/user-guide/nexthink-query-language-nql/nql-keywords.md) section.

## Pattern matching <a href="#nqlsyntaxoverview-patternmatching" id="nqlsyntaxoverview-patternmatching"></a>

Use wildcard characters such as `*` and `?` for text filters.

`*` replaces any number of characters

`?` replaces any single character

For example, listing all binaries with a name starting with **dll** and finishing with **.exe** translates into the following query:

{% code overflow="wrap" lineNumbers="true" %}

```
binaries during past 24h
| where binary.name == "dll*.exe"
| list size,name,version 
| sort size desc 
| limit 100
```

{% endcode %}

* [NQL time selection](/platform/~/changes/Sh4xqs4GDClkDKT9Hvux/user-guide/nexthink-query-language-nql/nql-syntax-overview/nql-time-selection.md)
* [NQL data types](/platform/~/changes/Sh4xqs4GDClkDKT9Hvux/user-guide/nexthink-query-language-nql/nql-syntax-overview/nql-data-types.md)


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.nexthink.com/platform/~/changes/Sh4xqs4GDClkDKT9Hvux/user-guide/nexthink-query-language-nql/nql-syntax-overview.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.