Nexthink Link Generator

Nexthink Link Generator — by Edge Solutions & Consulting Stop building Nexthink investigation queries from scratch every time a ticket comes in. The Nexthink Link Generator is a browser extension built by Edge Solutions & Consulting for IT support teams, service desk engineers, and DEX practitioners who work in Nexthink Infinity daily. It eliminates the manual overhead of constructing NQL queries, navigating to the investigation editor, filtering by device, and setting time ranges — turning a 5-step process into a single click. What it does Open the side panel, type a device name, pick an investigation template, choose a time range, and click Generate. You get a direct URL that opens Nexthink Infinity pre-loaded with the right query, the right filter, and the right time window — ready to run. Paste it into a ServiceNow ticket, drop it in a Teams message, or open it directly. Anyone on your team with Nexthink access can click that link and be in the investigation immediately, no NQL knowledge required. Why this matters Nexthink is a powerful platform, but the gap between "I need to investigate this device" and "I'm looking at the right data" has always involved friction. Device names need to be copied, tables need to be selected, filters need to be constructed, time ranges need to be set. For L1 and L2 support teams working dozens of tickets a day, that friction compounds fast. The Nexthink Link Generator removes that friction entirely. Your most-used investigation patterns are pre-built, validated against live Nexthink environments, and ready to use. Experienced engineers can build new templates and share them across the team. Investigations that used to take three minutes to set up now take ten seconds. Investigation Templates The extension ships with 13 validated investigation templates covering the most common support and operations scenarios: Device Investigations (device.name or collector.uid): Device overview — OS version, last logged-in user, last seen date, Collector UID. The first query any support tech should run on an unfamiliar device. Device health — CPU usage, normalized CPU, memory (used, free, cached), and system drive free space. Identify performance issues at a glance. Software inventory — Every installed package on the device with name, version, publisher, and type. Software rationalization and compliance in one click. Execution crashes — Application crashes with binary name, version, crash count, and foreground/background indicator. Isolate unstable software instantly. Connection events — Outbound network connections with destination domain, port, traffic volumes, and failed connection counts. Network troubleshooting without leaving the ticket. Logon history — User logon sessions per device. Identify shared devices, account misuse, or unusual access patterns. Remote Action executions — Full Remote Action history including trigger method, status, and status details. Know exactly what ran on a device and what it returned. Network Investigations (device IP address): IP Device overview — All devices matching an IP address or subnet range, with OS and user context. IP Connection events — Outbound connections from devices at a specific IP or subnet. IP Device health — Performance metrics for all devices in an IP range. IP Execution crashes — Application crashes filtered by device IP. IP Logon history — User logons filtered by device IP. IP Software inventory — Installed packages on devices at a specific IP. IP-based investigations support single IPs, multiple IPs, CIDR subnet notation (e.g. 10.0.0.0/24), and mixed combinations of IPs and CIDR ranges in a single query — using the correct no-quotes syntax for Nexthink's ipAddress data type. Multi-Device Support Switch to Multiple mode and add as many device names as you need — each appears as a removable tag. The extension generates the correct NQL in ["device1", "device2"] format automatically. Use this for incident response when an alert affects a group of devices, or for proactive investigation across a fleet. Detail and Summarize Views Every event-based template supports two view modes: Detail view returns raw event rows — every crash, every connection event, every logon. Best when you need to understand exactly what happened on a specific device at a specific time. Summarize view aggregates the data — total crashes per binary, average CPU per device, total outbound traffic per destination. Best when you're comparing multiple devices or building a picture across a fleet. Flexible Time Ranges Preset time windows from 15 minutes to 30 days cover the most common investigation windows. Switch to Custom mode for exact From/To times at 15-minute granularity, up to 30 days back — matching Nexthink's operational data retention window. Favorites Star any template to pin it to a Favorites group at the top of the list. Favorited templates disappear from their original category — no duplicates. Unfavorite them and they return exactly where they were. Favorites persist between sessions, stored privately in your browser. History The History tab keeps your last 30 generated links. Click any entry to copy the URL back to your clipboard. Useful when you need to re-run an investigation from an earlier ticket or share a link you generated earlier in the day. Auto-Detection When you're browsing a Nexthink Infinity page, the extension watches for device names in the page content, URL, and investigation editor. When it detects one, it auto-fills the device field in the side panel and generates the link immediately — no copy and paste required. Import Any NQL Query as a Template If you've built a useful query in the Nexthink investigation editor, you can convert it into a reusable template in seconds. Paste the raw NQL into the Import box, and the extension automatically detects the device filter pattern and replaces it with the correct runtime placeholder. Timeframe selections are replaced automatically too. Category is inferred from the t…