快速入门:在 Azure 数据资源管理器 Web UI 中查询数据Quickstart: Query data in Azure Data Explorer Web UI

Azure 数据资源管理器是一项快速且高度可缩放的数据探索服务,适用于日志和遥测数据。Azure Data Explorer is a fast and highly scalable data exploration service for log and telemetry data. Azure 数据资源管理器提供了可用于运行和共享查询的 Web 应用程序。Azure Data Explorer provides a web application that enables you to run and share queries. 该应用程序可在 Azure 门户中使用,也可作为独立的 Web 应用程序使用。The application is available in the Azure portal and as a stand-alone web application. 在本文中,将使用独立版本,该版本允许连接到多个群集并共享指向查询的深层链接。In this article, you work in the stand-alone version, which enables you to connect to multiple clusters and to share deep links to your queries.

如果没有 Azure 订阅,请在开始前创建一个试用订阅If you don't have an Azure subscription, create a Trial Subscription before you begin.


除 Azure 订阅外,还需测试群集和数据库才能完成此快速入门。In addition to an Azure subscription, you need a test cluster and database to complete this quickstart.

登录应用程序Sign in to the application

登录到应用程序Sign in to the application.

添加群集Add clusters

首次打开应用程序时,未进行任何连接。When you first open the application, there are no connections.


开始运行查询前,必须先将连接添加到至少一个群集中。You must add a connection to at least one cluster before you can start running queries. 在本部分中,将连接添加到我们为帮助学习而设置的 Azure 数据资源管理器 help 群集,以及在之前的快速入门中创建的测试群集中。In this section, you add connections to the Azure Data Explorer help cluster that we have set up to aid learning, and to the test cluster you created in a previous quickstart.

  1. 在应用程序的左上角,选择“添加群集”。In the upper-left of the application, select Add cluster.

  2. 在“添加群集”对话框中,输入 URI,然后选择“添加” 。In the Add cluster dialog box, enter the URI, then select Add.

    可使用 help 群集 URI https://help.kusto.chinacloudapi.cnYou may use the help cluster URI, https://help.kusto.chinacloudapi.cn. 如果你有自己的群集,请提供自己的群集 URI。If you have your own cluster, provide the URI of your cluster. 例如,https://mydataexplorercluster.chinanorth2.kusto.chinacloudapi.cn,如下图所示:For example, https://mydataexplorercluster.chinanorth2.kusto.chinacloudapi.cn as in the following image:

    门户中的服务器 URI

  3. 在左侧窗格中,现在应看到 help 群集。In the left pane, you should now see the help cluster. 展开“示例”数据库,以便可查看有权访问的示例表。Expand the Samples database so that you can see the sample tables that you have access to.


    我们在本快速入门后面部分以及其他 Azure 数据资源管理器文章中使用 StormEvents 表。We use the StormEvents table later in this quickstart, and in other Azure Data Explorer articles.

现在添加创建的测试群集。Now add the test cluster you created.

  1. 选择“添加群集”。Select Add cluster.

  2. 在“添加群集”对话框中,以 https://<ClusterName>.<Region>.kusto.chinacloudapi.cn/ 格式输入测试群集 URL,然后选择“添加” 。In the Add cluster dialog box, enter your test cluster URL in the form https://<ClusterName>.<Region>.kusto.chinacloudapi.cn/, then select Add.

    在以下示例中,会看到 help 群集和一个新群集 docscluster.chinaeast2(完整 URL 为 https://docscluster.chinanorth2.kusto.chinacloudapi.cn/) 。In the example below, you see the help cluster and a new cluster, docscluster.chinaeast2 (full URL is https://docscluster.chinanorth2.kusto.chinacloudapi.cn/).


运行查询Run queries

现在可针对连接到的任一群集运行查询(假设测试群集中有数据)。You can now run queries against either cluster that you're connected to (assuming you have data in your test cluster). 我们将重点介绍 help 群集。We'll focus on the help cluster.

  1. 在左窗格中的 help 群集下,选择示例数据库 。In the left pane, under the help cluster, select the Samples database.

  2. 将以下查询复制并粘贴到查询窗口中。Copy and paste the following query into the query window. 在窗口顶部,选择“运行”。At the top of the window, select Run.

    | sort by StartTime desc
    | take 10

    此查询返回 StormEvents 表中的十条最新记录。This query returns the ten newest records in the StormEvents table. 结果的左侧应如下表所示。The left side of the result should look like the following table.

    表的屏幕截图,其中列出了 10 个风暴事件的开始时间、结束时间、事件叙述、事件 ID、状态和事件类型。

    下图显示了应用程序现在应处的状态,添加了群集以及带有结果的查询。The following image shows the state that the application should now be in, with clusters added, and a query with results.


  3. 将以下查询复制并粘贴到第一个查询下方的查询窗口中。Copy and paste the following query into the query window, below the first query. 请注意,它与首个查询在单独行上格式化的方式有何不同。Notice how it's not formatted on separate lines like the first query.

    StormEvents | sort by StartTime desc | project StartTime, EndTime, State, EventType, DamageProperty, EpisodeNarrative | take 10
  4. 单击窗口中的新建查询,该窗口将选择该查询。Click the new query in the window, which selects the query. 按 Shift+Alt+F 设置查询格式,如下所示。Press Shift+Alt+F to format the query, so it looks like the following.


  5. 按 Shift+Enter,这是运行查询的快捷方式。Press Shift+Enter, which is a shortcut to run a query.

    此查询返回与第一条记录相同的记录,但仅包括 project 语句中指定的列。This query returns the same records as the first one, but includes only the columns specified in the project statement. 结果应如下表所示。The result should look like the following table.

    表的屏幕截图,其中列出了 10 个风暴事件的开始时间、结束时间、状态、事件类型、损伤特性和事件叙述。

  6. 在查询窗口顶部,选择“撤回”。At the top of the query window, select Recall.

    查询窗口现在显示第一个查询的结果集,而无需重新运行该查询。The query window now shows the result set from the first query without having to rerun the query. 通常在分析期间,会运行多个查询,通过“撤回”可以重新访问先前查询的结果。Often during analysis, you run multiple queries, and Recall enables you to revisit the results of previous queries.

  7. 让我们再运行一个查询来查看不同类型的输出。Let's run one more query to see a different type of output.

    | summarize event_count=count(), mid = avg(BeginLat) by State
    | sort by mid
    | where event_count > 1800
    | project State, event_count
    | render columnchart

    结果应如下图所示。The result should look like the following chart.



查询表达式中的空白行可能影响执行查询的那一部分。Blank lines in the query expression can affect which part of the query is executed.

如果未选定文本,则假定以空行分隔查询或命令。If no text selected, it's assumed that the query or command is separated by empty lines. 如果选定了文本,则运行选定的文本。If text is selected, the selected text is run.

使用网格型Work with the table grid

现在你已了解了基本查询的工作原理,让我们看看如何使用网格型来自定义结果并进行进一步分析。Now you've seen how basic queries work, let's look at how you can use the table grid to customize results and do further analysis.

  1. 重新运行第一个查询。Rerun the first query. 将鼠标悬停在“州”列上,选择菜单,然后选择“按州分组” 。Mouse-over the State column, select the menu, and select Group by State.


  2. 在网格中,展开加利福尼亚州,以查看该州的记录。In the grid, expand California to see records for that state.

    查询结果网格的屏幕截图。加利福尼亚州组已展开,可以看见 3 行数据,内容为加利福尼亚州的事件。

    进行探索性分析时,此类型的分组可能会有所帮助。This type of grouping can be helpful when doing exploratory analysis.

  3. 将鼠标悬停在“组”列上,然后选择“重置列” 。Mouse-over the Group column, then select Reset columns.


    此操作将网格返回到其原始状态。This returns the grid to its original state.

  4. 运行以下查询。Run the following query.

    | sort by StartTime desc
    | where DamageProperty > 5000
    | project StartTime, State, EventType, DamageProperty, Source
    | take 10
  5. 在网格的右侧,选择“列”以查看工具面板。On the right side of the grid, select Columns to see the tool panel.


    此面板的功能类似于 Excel 中的数据透视表字段列表,可在网格中执行更多分析。This panel functions similarly to the pivot table field list in Excel, enabling you to do more analysis in the grid itself.

  6. 选择“透视模式”,然后按以下方式拖动列:将“状态”拖动到“行组”;将“DamageProperty”拖动到“值”,并将“EventType”拖动到“列标签” 。Select Pivot Mode, then drag columns as follows: State to Row groups; DamageProperty to Values; and EventType to Column labels.


    结果应如以下数据透视表所示。The result should look like the following pivot table.


    请注意佛蒙特州和阿拉巴马州各有两个属于同一类别的事件,而德克萨斯州有两个不同类别的事件。Notice how Vermont and Alabama each have two events under the same category, while Texas has two events under different categories. 通过数据透视表可以快速发现这样的情况,它们是快速分析的绝佳工具。Pivot tables enable you to quickly spot things like this; they are a great tool for quick analysis.

共享查询Share queries

很多时候,你希望共享创建的查询。Many times, you want to share the queries you create.

  1. 在查询窗口中,选择复制的第一个查询。In the query window, select the first query you copied in.

  2. 在查询窗口顶部,选择“共享”。At the top of the query window, select Share.


下拉列表中提供了以下选项:The following options are available in the drop-down:

可提供深层链接,以便有权访问群集的其他用户可运行查询。You can provide a deep link so that other users with access to the cluster can run the queries.

  1. 在“共享”中,选择“将查询链接到剪贴板” 。In Share, select Link, query to clipboard.

  2. 将链接和查询复制到文本文件。Copy the link and query to a text file.

  3. 将链接粘贴到新的浏览器窗口中。Paste the link into a new browser window. 运行查询后,结果应如下所示。The result should look like the following after the query runs.


固定到仪表板Pin to dashboard

在 Web UI 中通过查询完成数据探索并找到所需的数据后,可将其固定到仪表板中以便持续监视。When you complete data exploration using queries in the Web UI and find the data you need, you can pin it to a dashboard for continuous monitoring.

若要固定查询:To pin a query:

  1. 在“共享”中,选择“固定到仪表板” 。In Share, select Pin to dashboard.

  2. 在“固定到仪表板”窗格中:In the Pin to dashboard pane:

    1. 提供查询名称。Provide a Query name.
    2. 选择“使用现有查询”或“创建新查询” 。Select Use existing or Create new.
    3. 提供仪表板名称Provide Dashboard name
    4. 选择“创建后查看仪表板”复选框(如果是新仪表板)。Select the View dashboard after creation checkbox (if it's a new dashboard).
    5. 选择“固定”Select Pin



“固定到仪表单”选项仅固定所选的查询。Pin to dashboard only pins the selected query. 要创建仪表板数据源并将显示命令转换为仪表板中的视觉对象,必须在数据库列表中选择相关数据库。To create the dashboard data source and translate render commands to a visual in the dashboard, the relevant database must be selected in the database list.

导出查询结果Export query results

要将查询结果导出到 CSV 文件,请选择“文件” > “导出到 CSV” 。To export the query results to a CSV file, select File > Export to CSV.

将结果导出到 CSV 文件

提供反馈Provide feedback

  1. 在应用程序的右上角,选择反馈图标In the upper-right of the application, select the feedback icon 反馈图标..

  2. 输入反馈,然后选择“提交”。Enter your feedback, then select Submit.

清理资源Clean up resources

未在此快速入门中创建任何资源,但如果要从应用程序中删除一个或两个群集,请右键单击群集并选择“删除连接”。You didn't create any resources in this quickstart, but if you'd like to remove one or both clusters from the application, right-click the cluster and select Remove connection.

后续步骤Next steps

Azure 数据资源管理器的编写查询Write queries for Azure Data Explorer