Enabling Cross-Engine Finder features

Contents

Enabling Cross-Engine Finder features

Overview

Starting from V6.19, the Cross-Engine Finder features let you target multiple Engines at the same time or, in some use cases, target an Engine that is different from the one to which the Finder is connected.

The Cross-Engine features impact the following Finder areas:

  • Investigations
  • User view
  • Device view
  • Service view
  • Search
  • Auto-complete

Because the Cross-Engine features for search and auto-complete are especially demanding in terms of connectivity and system load, they can be enabled separately.

Prerequisites

The connectivity between Nexthink components and the total number of devices determine the Cross-Engine features that can be enabled in your setup. Find below the configurations and values required to enable each level of the Cross-Engine features:

  • The Portal and the Engines are located in the same data center or have equivalent connectivity.
  • There is a good connectivity between Finder and Portal:
    • A bandwidth of 10 Mbps between Finder and Portal allows for the basic Cross-Engine features to be enabled (investigations, device view, user view, and service view across multiple Engines).
    • A bandwidth of 100 Mbps or higher between Finder and Portal,
      • where the total number of devices is below 50 K, allows for the full set of Cross-Engine features to be enabled (the basic features plus the search and the auto-complete).
      • where the total number of devices is above 50 K, contact Nexthink Support.

Keep the Cross-Engine features disabled if the prerequisites are not met.

Enabling the Cross-Engine Finder features from the Web Console

To enable the Cross-Engine Finder features:

  1. Log in to the Web Console of the master Appliance as administrator.
  2. Click the FINDER tab at the top of the window.
  3. In the General section, tick one of the following options under Cross-Engine Finder:
    CrossEngineConfiguration.png
    • Disabled: To disable all Cross-Engine features. This is the default option.
    • Enable investigations, device view, user view and service view across multiple Engines: To enable the targeting of multiple Engines when executing investigations or when analyzing the user and service views, as well as the ability to see the device view of devices that reside in another Engine.
    • Enable investigations, device view, user view, service view, search and auto-complete across multiple Engines: To enable the search over all Engines and to get word completion from every Engine, in addition to enabling the Cross-Engine features already present in the previous option. Note that the search across multiple Engines is limited to user and device objects.
  4. Click SAVE to permanently store your choice. The Portal is restarted if you modified the setting.

Individually disabling the Cross-Engine Finder features

Even when the Cross-Engine features are globally enabled in the Web Console, you may want to individually disable these features on some specific computers that run the Finder.

Disabling the Cross-Engine features can improve the performance of the Finder in environments with limited network bandwidth for users that do not need multi-Engine data, either because they usually work exclusively with one Engine or because their view is restricted to one Engine only.

To disable the Cross-Engine features for a single user, modify a value in the registry:

  1. On the computer where the Finder is installed, press Win+R to open the Run box.
  2. Type in regedit and press Enter to launch the Registry Editor.
  3. Browse the Windows registry in the Registry Editor and select the key HKEY_CURRENT_USER\Software\Nexthink.
    • If the value CrossEngineDisabled does not exist in the key:
      1. Right-click the area on the right-hand side of the Registry Editor that holds the list of values for the key.
      2. Select New -> DWORD (32-bit) Value from the context menu.
      3. Type in CrossEngineDisabled as the name of the value.
  4. Right-click the value with the name CrossEngineDisabled to change its data.
  5. Select Modify... in the context menu. The dialog to edit the value shows up.
  6. Set the value of the field Value data to 1 in the dialog.
  7. Click OK.

Setting the maximum number of Cross-Engine investigation results in the Finder

When the Cross-Engine features are enabled in the Finder, the List (all entities) view lets you examine the results of an investigation over all available Engines. Because the Finder receives answers from multiple Engines, which are gathered by the Portal, the potential number of results are higher than those of a single Engine. By default, the List (all entities) view displays a maximum number of 10 000 results.

To modify the maximum number of results displayed in the List (all entities) view of the Finder:

  1. Log in to the CLI of the master Appliance.
  2. Optional: If the Portal has no explicit configuration file, that is, if portal.conf does not exist in folder /var/nexthink/portal/conf, create it by copying the defaults from the sample configuration file:
    sudo cp /var/nexthink/portal/conf/portal.conf.sample \
    /var/nexthink/portal/conf/portal.conf
  3. Edit the configuration file of the Portal:
    sudo vi /var/nexthink/portal/conf/portal.conf
  4. Add the following line at the end of the configuration file. Change the default value of 10 000 results to the desired value:
    globalconfig.portal.finder-selector.max-rows = 10000
  5. Save your changes and exit the vi editor:
    :wq
  6. Restart the Portal for the new limit to apply:
    sudo systemctl restart nxportal

Individually modifying the maximum number of Cross-Engine results in the Finder

Besides the global configuration, each Finder user may individually set the maximum number of Cross-Engine results displayed in the List (all entities) view.

To change the maximum number of Cross-Engine results in the List (all entities) view for a single user, modify a value in the registry:

  1. On the computer where the Finder is installed, press Win+R to open the Run box.
  2. Type in regedit and press Enter to launch the Registry Editor.
  3. Browse the Windows registry in the Registry Editor and select the key HKEY_CURRENT_USER\Software\Nexthink.
    • If the value CrossEngineMaxResults does not exist in the key:
      1. Right-click the area on the right-hand side of the Registry Editor that holds the list of values for the key.
      2. Select New -> DWORD (32-bit) Value from the context menu.
      3. Type in CrossEngineMaxResults as the name of the value.
  4. Right-click the value with the name CrossEngineMaxResults to change its data.
  5. Select Modify... in the context menu. The dialog to edit the value shows up.
  6. Set the value of the field Value data to the number of maximum desired results.
  7. Click OK.