Kusto.Explorer 入门Getting started with Kusto.Explorer

Kusto.Explorer 是一个富桌面应用程序,可让你在易于使用的用户界面中使用 Kusto 查询语言来浏览数据。Kusto.Explorer is a rich desktop application that enables you to explore your data using the Kusto Query Language in an easy-to-use user interface. 此概述介绍了如何开始设置 Kusto.Explorer,并说明了将使用的用户界面。This overview explains how to get started with setting up your Kusto.Explorer and explains the user interface you will use.

借助 Kusto.Explorer,你可以:With Kusto.Explorer, you can:

安装 Kusto.ExplorerInstalling Kusto.Explorer

使用 Chrome 和 Kusto.ExplorerUsing Chrome and Kusto.Explorer

如果使用 Chrome 作为默认浏览器,请确保安装适用于 Chrome 的 ClickOnce 扩展:If you use Chrome as your default browser, make sure to install the ClickOnce extension for Chrome:

https://chrome.google.com/webstore/detail/clickonce-for-google-chro/kekahkplibinaibelipdcikofmedafmb/related?hl=en-US

用户界面概述Overview of the user interface

Kusto.Explorer 用户界面的设计使用基于选项卡和面板的布局,这类似于其他 Microsoft 产品的设计:The Kusto.Explorer user interface is designed with a layout based on tabs and panels, similar to that of other Microsoft products:

  1. 菜单面板上浏览选项卡以执行各种操作Navigate through the tabs on the menu panel to perform various operations
  2. 连接面板中管理连接Manage your connections in the connections panel
  3. 在脚本面板中创建要运行的脚本Create scripts to run in the script panel
  4. 在结果面板中查看脚本的结果View the results of the scripts in the results panel

Kusto Explorer 开始页面

Kusto.Explorer 菜单面板包含以下选项卡:Kusto.Explorer Menu panel includes the following tabs:

“主文件夹”选项卡Home tab

Kusto Explorer“主页”选项卡

“主页”选项卡显示最近使用过的功能,分为以下几个部分:The Home tab shows the most recently used functions, divided into sections:

“查询”部分Query section

Kusto Explorer“查询”部分

菜单Menu 行为Behavior
模式下拉菜单Mode dropdown
  • 查询模式:将查询窗口切换为脚本模式Query mode: Switches Query Window into a script mode. 可以加载命令并将其另存为脚本(默认值)Commands can be loaded and saved as scripts (default)
  • 搜索模式:单个查询模式,其中输入的每个命令都将立即被处理,并在结果窗口中显示结果Search mode: A single query mode where each command entered is processed immediately and presents a result in the Result Window
  • Search++ 模式:可在一个或多个表中使用搜索语法搜索字词。Search++ mode: Allows searching for a term using search syntax across one or more tables. 了解有关使用 Search++ 模式的详细信息Learn more about using Search++ Mode
新选项卡New Tab 打开新选项卡以查询 KustoOpens a new tab for querying Kusto

“共享”部分Share section

Kusto Explorer 共享菜单

菜单Menu 行为Behavior
将数据导出到剪贴板Data To Clipboard 将查询和数据集导出到剪贴板。Exports Query and data set to a clipboard. 如果显示图表,则会将图表导出为位图If a chart is presented, it exports the chart as bitmap
将结果导出到剪贴板Result To Clipboard 将数据集导出到剪贴板。Exports the data set to a clipboard. 如果显示图表,则会将图表导出为位图If a chart is presented, it exports the chart as bitmap
将查询导出到剪贴板Query to Clipboard 将查询导出到剪贴板Exports the Query to a clipboard

“可视化效果”部分Visualizations section

Kusto Explorer 菜单可视化效果

菜单Menu 行为Behavior
面积图Area chart 显示一个面积图,其中 X 轴是第一列(必须是数字)。Displays an area chart in which the X-axis is the first column (must be numeric). 所有数字列都映射到不同的序列(Y 轴)All numeric columns are mapped to different series (Y-axis)
柱形图Column Chart 显示一个柱形图,其中所有数值列都映射到不同的序列(Y 轴)。Displays a column chart where all numeric columns are mapped to different series (Y-axis). 数值前的文本列是 X 轴(可以在 UI 中进行控制)The text column before numeric is the X-axis (can be controlled in the UI)
条形图Bar Chart 显示一个条形图,其中所有数值列都映射到不同的序列(X 轴)。Displays a bar chart where all numeric columns are mapped to different series (X-axis). 数值前的文本列是 Y 轴(可以在 UI 中进行控制)The text column before numeric is the Y-axis (can be controlled in the UI)
堆积面积图Stacked Area chart 显示一个堆积面积图,其中 X 轴是第一列(必须是数字)。Displays a stacked area chart in which the X-axis is the first column (must be numeric). 所有数字列都映射到不同的序列(Y 轴)All numeric columns are mapped to different series (Y-axis)
时间线图表Timeline Chart 显示一个时间图,其中 X 轴是第一列(必须是日期/时间)。Displays a time chart in which the X-axis is the first column (must be datetime). 所有数字列都映射到不同的序列(Y 轴)。All numeric columns are mapped to different series (Y-axis).
折线图Line Chart 显示一个折线图,其中 X 轴是第一列(必须是数字)。Displays a line chart in which the X-axis is the first column (must be numeric). 所有数字列都映射到不同的序列(Y 轴)。All numeric columns are mapped to different series (Y-axis).
异常图Anomaly Chart 类似于时间图,但使用机器学习异常算法查找时序数据中的异常。Similar to timechart, but finds anomalies in time series data, using the machine learning anomalies algorithm. 对于异常情况检测,Kusto.Explorer 使用 series_decompose_anomalies 函数。(*)For anomaly detection, Kusto.Explorer uses the series_decompose_anomalies function.(*)
饼图Pie Chart 显示一个饼图,其中色轴是第一列。Displays a pie chart in which the color-axis is the first column. θ 轴(必须是一个度量值,转换为百分比)是第二列。The theta-axis (must be a measure, converted to percent) is the second column.
时间阶梯Time Ladder 显示一个梯形图,其中 X 轴是最后两列(必须是日期/时间)。Displays a ladder chart in which the X-axis is the last two columns (must be datetime). Y 轴是其他列的组合。The Y-axis is a composite of the other columns.
散点图Scatter Chart 显示一个散点图,其中 X 轴是第一列(必须是数字)。Displays a point graph in which the X-axis is the first column (must be numeric). 所有数字列都映射到不同的序列(Y 轴)。All numeric columns are mapped to different series (Y-axis).
透视图Pivot Chart 显示一个透视表和透视图,选择数据、列、行和各种图表类型时具有全面的灵活性。Displays a pivot table and pivot chart that gives the full flexibility of selecting data, columns, rows, and various chart types.
时间透视Time Pivot 在事件时间线上进行交互式导航(沿时间轴旋转)Interactive navigation over the events time-line (pivoting on time axis)

(*) 异常图:该算法需要时序数据,其中包含两列:(*) Anomaly Chart: The algorithm expects timeseries data, which consists of two columns:

  1. 固定时间间隔 bucket 中的时间Time in fixed interval buckets
  2. 异常情况检测的数值 若要在 Kusto.Explorer 中生成时序数据,请按时间字段汇总并制定,按时间字段汇总并指定时间 bucket 箱。Numeric value for anomaly detection To produce timeseries data in Kusto.Explorer, summarize by the time field and specify the time bucket bin.

“视图”部分View section

Kusto Explorer“视图”菜单

菜单Menu 行为Behavior
完整视图模式Full View Mode 通过隐藏功能区菜单和连接面板来最大化工作空间。Maximizes the work space by hiding the ribbon menu and Connection Panel. 可通过选择“主页” > “完整视图模式”或按 F11 退出完整视图模式 。Exit Full View Mode by selecting Home > Full View Mode, or by pressing F11.
隐藏空列Hide Empty Columns 从数据网格中删除空列Removes empty columns from the data grid
折叠单数列Collapse Singular Columns 折叠包含单数值的列Collapses columns with singular values
浏览列值Explore Column Values 显示列值分布Shows column values distribution
增大字体Increase Font 增大“查询”选项卡和“结果”数据网格的字体大小Increases the font size of the query tab and of the results data grid
减小字体Decrease Font 减小“查询”选项卡和“结果”数据网格的字体大小Decreases the font size of the query tab and of the results data grid

(*) 数据视图设置:Kusto.Explorer 跟踪每一组唯一列使用的设置。(*) Data View Settings: Kusto.Explorer keeps track of what settings are used per unique set of columns. 因此,当对列进行重新排序或删除列时,将保存数据视图,并在检索到具有相同列的数据时重用该视图。So when columns are reordered or removed, the data view is saved and will be reused whenever the data with the same columns is retrieved. 若要将该视图重置为其默认值,请在“视图”选项卡中,选择“重置视图” 。To reset the view to its defaults, in the View tab, select Reset View.

“文件”选项卡File tab

Kusto Explorer“文件”选项卡

菜单Menu 行为Behavior
---------查询脚本------------------Query Script---------
新选项卡New Tab 打开新选项卡窗口以查询 KustoOpens a new tab window for querying Kusto
打开文件Open File 将数据从 *.kql 文件加载到活动脚本面板Loads data from a *.kql file to the active script panel
保存到文件Save To File 将活动脚本面板的内容保存到 *kql 文件Saves the content of the active script panel to *.kql file
关闭选项卡Close Tab 关闭当前选项卡窗口Closes the current tab window
---------保存数据------------------Save Data---------
将数据导出到 CSVData To CSV 将数据导出到 CSV(逗号分隔值)文件Exports data to a CSV (comma-separated-values) file
将数据导出到 JSONData To JSON 将数据导出到 JSON 格式的文件Exports data to a JSON formatted file
将数据导出到 ExcelData To Excel 将数据导出到 XLSX (Excel) 文件Exports data to an XLSX (Excel) file
将数据导出到文本Data To Text 将数据导出到 TXT(文本)文件Exports data to a TXT (text) file
将数据导出到 KQL 脚本Data To KQL Script 将查询导出到脚本文件Exports Query to a script file
将数据导出到结果Data To Results 将查询和数据导出到结果 (QRES) 文件Exports Query and data to a Results (QRES) file
运行查询并保存到 CSVRun Query Into CSV 运行查询并将结果保存到本地 CSV 文件Runs a query and saves the results to a local CSV file
---------加载数据------------------Load Data---------
从结果From Results 从结果 (QRES) 文件加载查询和数据Loads Query and data from a Results (QRES) file
---------剪贴板------------------Clipboard---------
将查询和结果导出到剪贴板Query and Results To Clipboard 将查询和数据集导出到剪贴板。Exports Query and data set to a clipboard. 如果显示图表,则会将图表导出为位图If a chart is presented, it exports the chart as a bitmap
将结果导出到剪贴板Result To Clipboard 将数据集导出到剪贴板。Exports data set to a clipboard. 如果显示图表,则会将图表导出为位图If a chart is presented, it exports the chart as a bitmap
将查询导出到剪贴板Query to Clipboard 将查询导出到剪贴板Exports the Query to a clipboard
---------结果------------------Results---------
清除结果缓存Clear results cache 清除以前执行的查询的缓存结果Clears cached results of previously executed queries

“连接”选项卡Connections tab

Kusto Explorer“连接”选项卡

菜单Menu 行为Behavior
---------组------------------Groups---------
添加组Add Group 添加新的 Kusto 服务器组Adds a new Kusto Server group
重命名组Rename Group 重命名现有的 Kusto 服务器组Renames the existing Kusto Server group
删除组Remove Group 删除现有的 Kusto 服务器组Removes the existing Kusto Server group
---------群集------------------Clusters---------
导入连接Import Connections 从指定连接的文件中导入连接Imports connections from a file specifying connections
导出连接Export Connections 将连接导出到文件Exports connections to a file
添加连接Add Connection 添加新的 Kusto 服务器连接Adds a new Kusto Server connection
编辑连接Edit Connection 打开一个对话框以编辑 Kusto 服务器连接属性Opens a dialog for Kusto Server connection properties editing
删除连接Remove Connection 删除到 Kusto 服务器的现有连接Removes the existing connection to Kusto Server
刷新Refresh 刷新 Kusto 服务器连接的属性Refreshes properties of a Kusto server connection
---------安全性------------------Security---------
检查 ADD 主体Inspect Your ADD Principal 显示当前活动用户详细信息Shows currents active user details
从 AAD 注销Sign-out From AAD 注销连接到 AAD 的当前用户Signs-out the current user from the connection to AAD
---------数据范围------------------Data Scope---------
缓存范围Caching scope
  • 仅对热数据缓存执行热 DataExecute 查询Hot DataExecute queries only on hot data cache
  • 所有数据:对所有可用数据执行查询(默认)All Data: Execute queries on all available data (default)
日期/时间列DateTime Column 用于时间初级筛选器的列的名称Name of column which may be used for time pre-filter
时间筛选器Time Filter 时间初级筛选器的值Value of time pre-filter

“视图”选项卡View tab

Kusto Explorer“视图”选项卡

菜单Menu 行为Behavior
---------外观------------------Appearance---------
完整视图模式Full View Mode 通过隐藏功能区菜单和连接面板来最大化工作空间Maximizes the work space by hiding the ribbon menu and Connection Panel
增大字体Increase Font 增大“查询”选项卡和“结果”数据网格的字体大小Increases the font size of the query tab and of the results data grid
减小字体Decrease Font 减小“查询”选项卡和“结果”数据网格的字体大小Decreases the font size of the query tab and of the results data grid
重置布局Reset Layout 重置工具的停靠控件和窗口的布局Resets the layout of the tool's docking controls and windows
重命名“文档”选项卡Rename Document Tab 重命名所选的选项卡Rename the selected tab
---------数据视图------------------Data View---------
重置视图Reset View 将数据视图设置重置为其默认值 (*)Resets data view settings to its defaults (*)
浏览列值Explore Column Values 显示列值分布Shows column values distribution
将焦点置于查询统计信息Focus on Query Statistics 查询完成时,将焦点更改为查询统计信息,而不是查询结果Changes the focus to query statistics instead of query results upon query completion
隐藏重复项Hide Duplicates 切换从查询结果中删除重复行Toggles removal of the duplicate rows from the query results
隐藏空列Hide Empty Columns 切换从查询结果中删除空列Toggles removal of empty columns from the query results
折叠单数列Collapse Singular Columns 切换折叠包含单数值的列Toggles collapsing columns with singular value
---------数据筛选------------------Data Filtering---------
筛选搜索中的行Filter Rows In Search 切换选项以仅显示查询结果搜索中的匹配行 (Ctrl+F)Toggles the option to show only matching rows in query results search (Ctrl+F)
---------可视化效果------------------Visualizations---------
可视化效果Visualizations 请参阅上述的可视化效果See Visualizations, above.

(*) 数据视图设置:Kusto.Explorer 跟踪每一组唯一列使用的设置。(*) Data View Settings: Kusto.Explorer keeps track of the settings used per unique set of columns. 当对列进行重新排序或删除列时,将保存数据视图,并在检索到具有相同列的数据时重用该视图。When columns are reordered or removed, the data view is saved and will be reused whenever the data with the same columns is retrieved. 若要将该视图重置为其默认值,请在“视图”选项卡中,选择“重置视图” 。To reset the view to its defaults, in the View tab, select Reset View.

“工具”选项卡Tools tab

Kusto Explorer“工具”选项卡

菜单Menu 行为Behavior
---------IntelliSense------------------IntelliSense---------
启用 IntelliSenseEnable IntelliSense 启用和禁用脚本面板上的 IntelliSenseEnables and disables IntelliSense on the Script Panel
---------分析------------------Analyze---------
查询分析器Query Analyzer 启动查询分析器工具Launches the Query Analyzer tool
查询检查器Query Checker 分析当前查询并输出一组适用的改进建议Analyzes the current query and outputs a set of applicable improvement recommendations
计算器Calculator 启动计算器Launches the calculator
---------分析------------------Analytics---------
分析报表Analytical Reports 打开包含多个预建报表的仪表板以进行数据分析Opens a dashboard with multiple pre-built reports for data analysis
---------转换------------------Translate---------
查询到 Power BIQuery to Power BI 将查询转换为适用于在 Power BI 中使用的格式Translates a query to a format suitable for using in Power BI
---------选项------------------Options---------
重置选项Reset Options 将应用程序设置设置为默认值Sets application settings to default values
选项Options 打开用于配置应用程序设置的工具。Opens a tool for configuring application settings. 详细了解 Kusto.Explorer 选项Learn more about Kusto.Explorer options.

“监视”选项卡Monitoring tab

Kusto Explorer“监视”选项卡

菜单Menu 行为Behavior
---------监视------------------Monitor---------
群集诊断Cluster Diagnostics 显示连接面板中当前选定的服务器组的运行状况摘要Shows a health summary for the Server Group currently selected in Connections Panel
最新数据:所有表Latest data: All tables 显示当前所选数据库的所有表中的最新数据的摘要Shows a summary of the latest data in all tables of the currently selected database
最新数据:所选表Latest data: Selected table 在状态栏中显示所选表中的最新数据Shows in the status bar the latest data in the selected table

“管理”选项卡Management tab

Kusto Explorer“管理”选项卡

菜单Menu 行为Behavior
---------授权主体------------------Authorized Principals---------
管理群集授权主体Manage Cluster Authorized Principals 支持为授权用户管理群集的主体Enables managing a cluster's principals for authorized users
管理数据库授权主体Manage Database Authorized Principals 支持为授权用户管理数据库的主体Enables managing a database's principals for authorized users
管理表授权主体Manage Table Authorized Principals 支持为授权用户管理表的主体Enables managing a table's principals for authorized users
管理函数授权主体Manage Function Authorized Principals 支持为授权用户管理函数的主体Enables managing a function's principals for authorized users

“帮助”选项卡Help tab

Kusto Explorer“帮助”选项卡

菜单Menu 行为Behavior
---------文档------------------Documentation---------
帮助Help 打开指向 Kusto 联机文档的链接Opens a link to the Kusto online documentation
新增功能What's new 打开列出所有 Kusto.Explorer 更改的文档Opens a document that lists all Kusto.Explorer changes
报告问题Report Issue 打开包含以下两个选项的对话框:Opens a dialog with two options:
  • 报告与服务相关的问题Report issues related to service
  • 报告客户端应用程序中的问题Report issues in the client application
建议功能Suggest Feature 打开指向 Kusto 反馈论坛的链接Opens a link to the Kusto feedback forum
检查更新Check Updates 检查 Kusto.Explorer 的版本是否有更新Checks if there are updates to your version of Kusto.Explorer

“连接”面板Connections panel

Kusto Explorer“连接”面板

“连接”窗格显示所有已配置的群集连接。The Connections pane shows all the configured cluster connections. 对于每个群集,将显示它们存储的数据库、表和属性(列)。For each cluster the databases, tables, and attributes (columns) that they store are shown. 选择项(在主面板中为搜索/查询设置隐式上下文),或双击项可将名称复制到“搜索/查询”面板。Select items (which sets an implicit context for the search/query in the main panel), or double-click items to copy the name to the search/query panel.

如果实际架构很大(如具有数百个表的数据库),则可以通过按CTRL + F 并输入所需实体名称的子字符串(不区分大小写)来进行搜索。If the actual schema is large (such as a database with hundreds of tables), you can search it by pressing CTRL+F and entering a substring (case-insensitive) of the entity name you're looking for.

Kusto.Explorer 支持从“查询”窗口控制“连接”面板,这对于脚本非常有用。Kusto.Explorer supports controlling the Connection panel from the query window, which is useful for scripts. 例如,你可以使用命令启动脚本文件,该命令通过使用以下语法指导 Kusto.Explorer 连接正通过脚本查询其数据的群集/数据库:For example, you can start a script file with a command that instructs Kusto.Explorer to connect to the cluster/database whose data is being queried by the script, by using the following syntax:

#connect cluster('help').database('Samples')

StormEvents | count

使用 F5 或类似内容运行每行。Run each line using F5, or similar.

控制连接到 Kusto.Explorer 的用户标识Control the user identity connecting to Kusto.Explorer

新连接的默认安全模式是 AAD 联合安全。The default security model for new connections is AAD-Federated security. 身份验证是通过 Azure Active Directory 使用默认 AAD 用户体验来完成的。Authentication is done through the Azure Active Directory using the default AAD user experience.

如果需要对身份验证参数进行更精细的控制,可以展开“高级:连接字符串”编辑框,并提供有效的 Kusto 连接字符串值。If you need finer control over the authentication parameters, you can expand the "Advanced: Connection Strings" edit box and provide a valid Kusto connection string value.

例如,存在于多个 AAD 租户中的用户有时需要使用其标识的特定投影。For example, users with a presence in multiple AAD tenants sometimes need to use a particular "projection" of their identities to a specific AAD tenant. 为此,请提供一个连接字符串,例如下面的连接字符串(将大写的单词替换为特定值):Do this by providing a connection string, such as the one below (replace words IN CAPITALS with specific values):

Data Source=https://CLUSTER_NAME.kusto.chinacloudapi.cn;Initial Catalog=DATABASE_NAME;AAD Federated Security=True;Authority Id=AAD_TENANT_OF_CLUSTER;User=USER_DOMAIN
  • AAD_TENANT_OF_CLUSTER 是托管群集的 AAD 租户的域名或 AAD 租户 ID (GUID)。AAD_TENANT_OF_CLUSTER is a domain name or AAD tenant ID (a GUID) of the AAD tenant in which the cluster is hosted. 这通常是拥有群集的组织的域名,例如 contoso.comThis is usually the domain name of the organization that owns the cluster, such as contoso.com.
  • USER_DOMAIN 是受邀加入该租户的用户的标识(例如 user@example.com)。USER_DOMAIN is the identity of the user invited into that tenant (for example, user@example.com).

备注

用户的域名不一定与托管群集的租户的域名相同。The domain name of the user is not necessarily the same as that of the tenant hosting the cluster.

Kusto Explorer 高级连接字符串

键盘快捷方式Keyboard shortcuts

你可能会发现,使用键盘快捷方式比使用鼠标执行操作的速度更快。You might find that using keyboard shortcuts enables you to perform operations faster than with the mouse. 请查看此 Kusto.Explorer 键盘快捷方式列表 以了解详细信息。Take a look at this list of Kusto.Explorer keyboard shortcuts to learn more.

表行颜色Table row colors

Kusto.Explorer 尝试在结果面板中解释每行的严重性或详细级别,并对它们进行相应的着色。Kusto.Explorer tries to interpret the severity or verbosity level of each row in the results panel and color them accordingly. 它通过将每列的非重复值与一组已知模式(“警告”、“错误”等)进行匹配来实现此目的。It does this by matching the distinct values of each column with a set of known patterns ("Warning", "Error", and so on).

若要修改输出配色方案或禁用此行为,请从“工具”菜单中,选择“选项” > “结果查看器” > “详细配色方案” 。To modify the output color scheme, or turn this behavior off, from the Tools menu, select Options > Results Viewer > Verbosity color scheme.

Kusto Explorer 配色方案修改

后续步骤Next steps

详细了解如何使用 Kusto.Explorer:Learn more about working with Kusto.Explorer:

详细了解 Kusto.Explorer 工具和实用程序:Learn more about Kusto.Explorer tools and utilities: