Software Metering NQL examples

Users and devices can be removed from Nexthink Infinity. When this occurs, software metering data may remain without an associated user or device. Refer to the Understanding Key Data Platform Concepts – Data Resolution and Retention documentation for more information about data retention for Inventory objects.

Querying the software metering data

Use Nexthink Query Language (NQL) in the Investigations module to access software metering data and other relevant information.

NQL data structure

The software_metering.events table contains software usage data. Each event has a resolution of 1 week. The retention of this data is 90 days.

Timeframe alignment between Software Metering and other tables in NQL

When using NQL to query Software Metering data, be aware that these events are grouped into 7-day periods. This means each event spans a full week, not a single day. The start of every software_metering.event is always Monday at 00:00 UTC.

Why it matters

Because of this weekly grouping, mismatched timeframes can lead to:

• Missing data,

• Including partial results, or

• Incorrect comparisons—especially when combining with events such as execution.events, which use finer time granularity.

For example, these two queries will return the same results because both start retrieving data on a Monday at 00:00 UTC:

software_metering.events from 2025-08-04 00:00:00 to 2025-08-08 10:00:00
| where application.name == "Firefox"
| summarize number_of_users = user.count()

execution.events from 2025-08-04 00:00:00 to 2025-08-08 10:00:00
| where application.name == "Firefox"
| summarize number_of_users = user.count()

Examples of NQL queries

Get a list of users underusing the desktop-based software, for example, using it less than two hours in the last 90d.

Users during past 30d
| with software_metering.events during past 90d
| where meter_configuration.name == "*office*"
| compute desktop_app_usage = desktop_focus_time.sum()
| where desktop_app_usage != NULL and desktop_app_usage < 2h
| list user.name, desktop_app_usage

Get a list of devices with an application package installed but no usage of the application in the last 90d.

Devices during past 30d
| include software_metering.events during past 90d
| where meter_configuration.name  == "visio"
| compute desktop_app_usage = desktop_focus_time.sum()
| include package.installed_packages
| where Package.name == "*visio*"
| where package.type == program
| compute packages_installed = device.count()
| where desktop_app_usage == NULL and packages_installed > 0
| list device.name, desktop_app_usage, packages_installed

If web usage time is not enabled: get a list of users who have accessed the web-based software at least once.

users during past 30d
| with software_metering.events during past 90d
| where meter_configuration.name == "*miro*"
| where web_is_used == TRUE
| compute event_where_web_was_used = count()
| where event_where_web_was_used > 0
| summarize users_using_application = count()