NQL time selection

In NQL you can specify the time frame in various formats.

Time selection formats

NQL during past

The during past clause allows you to filter your results by specifying a particular time period leading up to the present. The time can be expressed in minutes, hours, or days.

Examples:

Retrieving the number of navigations in the past 45 minutes.

web.page_views during past 45min
| summarize total_navigations = number_of_page_views.sum()

Retrieving the number of navigations in the past 1 hour.

web.Page_views during past 1h
| summarize total_navigations = number_of_page_views.sum() 

Retrieving the number of navigations in the past 12 hours.

web.Page_views during past 12h
| summarize total_navigations = number_of_page_views.sum() 

Retrieving the number of navigations in the past 3 days.

web.Page_views during past 3d
| summarize total_navigations = number_of_page_views.sum() 

NQL from to

The from to clause allows you to apply custom timeframe filters by specifying the start and end times for the desired period.

Specifying a fixed timeframe

Apply a timeframe filter by specifying fixed datetime values for the start and end of the period.

Examples:

The number of navigations from June 1, 2023 to June 15, 2023

web.page_views from Jun 1, 2023 to Jun 15, 2023
| summarize total_navigations = number_of_page_views.sum() 

The number of navigations from June 15, 2023 at 12:30 to June 15, 2023 at 16:15

web.page_views from Jun 15, 2023, 12:30 to Jun 15, 2023, 16:15
| summarize total_navigations = number_of_page_views.sum()

The number of navigations from 2023-02-01 00:00:00 to 2023-02-28 23:45:00

web.page_views from 2023-02-01 00:00:00 to 2023-02-28 23:45:00
| summarize total_navigations = number_of_page_views.sum()

The number of navigations from 2023-02-01 to 2023-02-28

web.page_views from 2023-02-01 to 2023-02-28
| summarize total_navigations = number_of_page_views.sum()

For more information about the allowed date formats, refer to the NQL data types section. Note that the autocomplete functionality in the NQL editor provides suggestions with available data formats.

Specifying a relative timeframe

Apply a timeframe filter by defining a time window relative to the current time, for example: 15m ago, 2h ago, 1d ago.

The time can be expressed in minutes, hours or days.

Examples:

The number of navigations from the previous day.

web.page_views from 1d ago to 1d ago
| summarize total_navigations = number_of_page_views.sum() 

The number of navigations grouped into 7-day intervals over a consecutive three-week period.

devices
| include web.page_views from 21d ago to 13d ago
| compute week1 = number_of_page_views.sum()
| include web.page_views from 14d ago to 8d ago
| compute week2 = number_of_page_views.sum()
| include web.page_views during past 7d
| compute current_week = number_of_page_views.sum()

NQL on

The on clause allows you to select a specific day when querying data.

Examples:

The number of navigations on July 15, 2023

web.page_views on Jul 15, 2023
| summarize total_navigations = number_of_page_views.sum() 

web.page_views on 2023-06-15
| summarize total_navigations = number_of_page_views.sum() 

NQL datetime functions

You can further customize your time selection with an NQL where conditions, to specify time windows relative to points in time other than the current time, for example, business hours, business week, or specific days of the month.

Refer to NQL datetime functionsfor more information.

Time granularity and retention

You have the flexibility to choose the precision level for time selection. Use minutes or hours in NQL time specification to retrieve more granular data. Use days to retrieve less granular data typically covering a longer time span.

When specifying timeframes at the day level, without a specific time (for example, during past 2d, June 1, 2023 or 1d ago), the system defaults to include:

• Start of the period: 00:00:00 (midnight) on the start date.

• End of the period: 23:59:59 on the end date.

This ensures that the entire day(s) within the specified range are included.

Data storage and granularity also depend on specific tables. Refer to the Data resolution and retention documentation page for more details.

Retrieving high-resolution data for Desktop Virtualization

By default, VDI event data are available with 5-minute or 1-day resolution, depending on time selection in your NQL query. To increase VDI data resolution, add by 30s at the end of the time selection in the query. High-resolution data is available for the past 2 days.

The examples below show how to retrieve high-resolution data from vdi_events.

Increasing data resolution from 1 day to 30 seconds.

session.vdi_events during past 1d by 30s

session.vdi_events on 2024-08-04 by 30s

Increasing data resolution from 5 minutes to 30 seconds.

session.vdi_events during past 24h by 30s

session.vdi_events from Nov 08, 2024, 15:15 to Nov 08, 2024, 17:30 by 30s

Timezones

When the Nexthink cloud instance is located in a different timezone from that of the user, the time selection units determine which timezone is considered for defining the beginning and end of the specified time period.

• Full-day timeframes (for example, during past 2d, from 2024-02-07 to 2024-02-08, on Feb 8, 2024) use the cloud instance timezone.

• Timeframes expressed in hours and minutes (for example, during past 15min, from 2024-02-07 14:45:00 to 2024-02-08 14:45:00) use the user timezone.

This distinction applies solely to the time period covered in the query. The results will always be displayed in the timezone of the user.

Example:

Let's consider how this would work in a real-world scenario.

Suppose two Nexthink users query the data using the Nexthink platform set to Eastern Time (ET).

• The first user operates in the same timezone as the Nexthink platform. The current time for them is November 11, 05:26:15.

• The second user operates in the Central European Time (CET) zone. The current time for them is November 11, 11:26:15.

In such a case, time-related queries made by the second Nexthink user will be translated into the corresponding timeframes, considering the timezone differences between CET and ET. This ensures accurate data retrieval and analytics, regardless of geographical location or timezone.

Timeframe selection	Nexthink user in the Eastern Time (ET) zone - the same zone as the Nexthink platform:	Nexthink user in the Central European Time (CET) zone:
past 15min	Nov 11, 05:15:00 AM – 05:30:00 AM ET​	Nov 11, 11:15:00 AM – 11:30:00 AM CET
past 2h	Nov 11, 04:00:00 AM – 06:00:00 AM ET​	Nov 11, 10:00:00 AM – 12:00:00 PM CET
past 24h	Nov 10, 06:00:00 AM – Nov 11 06:00:00 AM ET​	Nov 10, 12:00:00 PM – Nov 11, 12:00:00 PM CET
from 2021-11-11 00:00:00 to 2021-11-11 12:00:00	from 2021-11-11 12:00:00 AM to 2021-11-11 12:00:00 PM	from 2021-11-11 12:00:00 AM to 2021-11-11 12:00:00 PM
past 1d	Nov 11, 12:00:00 AM – Nov 12, 12:00:00 AM ET	Nov 11, 06:00:00 – Nov 12, 06:00:00 CET
on Nov 10, 2021	Nov 10, 12:00:00 AM – Nov 11, 12:00:00 AM ET​	Nov 10, 06:00:00 – Nov 11, 06:00:00 CET