Kusto.Explorer is a rich desktop application that allows you to explore your data using Kusto query language.
Jun 17, 2002 REDMOND, Wash., June 17, 2002 — Microsoft Corp. Today announced the availability of Microsoft® Internet Explorer 5.2 for Mac OS X, the latest update to the most popular browser available for the Macintosh operating system. The update includes a number of enhancements that make the browsing experience better for customers using Mac OS X. Internet Explorer 11 Release Preview brings the 'best in class' spelling engine and dictionaries used by Microsoft to the browser. Internet Explorer 11 Release Preview also supports autocorrection or 'correction-while-you-type'. Microsoft designer keyboard not pairing mac and windows 10. Mar 15, 2018 But third-party tools fill the gap and provide access to drives formatted with Apple’s HFS+ file system on Windows. This also allows you to restore Time Machine backups on Windows. If you know you’re going to use a drive on both Mac and Windows, you should use the exFAT file system.
Install the Kusto.Explorer tool
Alternatively, access your Kusto cluster with your browser at:https://<your_cluster>.kusto.windows.net. Replace <your_cluster> with your Azure Data Explorer cluster name.
If you use Chrome as your default browser, make sure to install the ClickOnce extension for Chrome:
Kusto Explorer window has several UI parts:
You might find that using keyboard shortcuts enables you to perform operations faster than with the mouse. Take a look at this list of Kusto.Explorer keyboard shortcuts.
Kusto.Explorer Menu panel includes the following tabs:
The Home tab shows the most recently used functions, divided into sections:
Menu | Behavior |
---|---|
Mode dropdown |
|
New Tab | Opens a new tab for querying Kusto |
Menu | Behavior |
---|---|
Data To Clipboard | Exports Query and data set to a clipboard. If a chart is presented, it exports the chart as bitmap |
Result To Clipboard | Exports the data set to a clipboard. If a chart is presented, it exports the chart as bitmap |
Query to Clipboard | Exports the Query to a clipboard |
Menu | Behavior |
---|---|
Area chart | Displays an area chart in which the X-axis is the first column (must be numeric) and all numeric columns are mapped to different series (Y-axis) |
Column Chart | Displays a column chart where all numeric columns are mapped to different series (Y-axis) and the text column before numeric is the X-axis (can be controlled in the UI) |
Bar Chart | Displays a bar chart where all numeric columns are mapped to different series (X-axis) and the text column before numeric is the Y-axis (can be controlled in the UI) |
Stacked Area chart | Displays a stacked area chart in which the X-axis is the first column (must be numeric) and all numeric columns are mapped to different series (Y-axis) |
Timeline Chart | Displays a time chart in which the X-axis is the first column (must be datetime) and all numeric columns are mapped to different series (Y-axis). |
Line Chart | Displays a line chart in which the X-axis is the first column (must be numeric) and all numeric columns are mapped to different series (Y-axis). |
Anomaly Chart | Similar to timechart, but finds anomalies in time series data, using the machine learning anomalies algorithm. For anomaly detection, Kusto.Explorer uses the series_decompose_anomalies function.(*) |
Pie Chart | Displays a pie chart in which the color-axis is the first column and the theta-axis (must be a measure, converted to percent) is the second column. |
Ladder Chart | Displays a ladder chart in which the X-axis is the last two columns (must be datetime) and the Y-axis is a composite of the other columns. |
Scatter Chart | Displays a point graph in which the X-axis is the first column (must be numeric) and all numeric columns are mapped to different series (Y-axis). |
Pivot Chart | Displaya a pivot table and pivot chart that gives the full flexibility of selecting data, columns, rows and various chart types. |
Time Pivot | Interactive navigation over the events time-line (pivoting on time axis) |
(*) Anomaly Chart:The algorithm expects timeseries data, which consists of two columns:
Menu | Behavior |
---|---|
Full View Mode | Maximizes the work space by hiding the ribbon menu and Connection Panel |
Hide Empty Columns | Removes empty columns from the data grid |
Collapse Singular Columns | Collapses columns with singular values |
Explore Column Values | Shows column values distribution |
Increase Font | Increases the font size of the query tab and of the results data grid |
Decrease Font | Decreases the font size of the query tab and of the results data grid |
(*) Data View Settings:Kusto.Explorer keeps track of what settings are used per unique set of columns. So when columns are reordered or removed, the data view is saved and will be reusedwhenever the data with the same columns is retrieved. To reset the view to its defaults, in the View tab, select Reset View.
Menu | Behavior |
---|---|
---------Query Script--------- | |
New Tab | Opens a new tab window for querying Kusto |
Open File | Loads data from a *.kql file to the active script panel |
Save To File | Saves the content of the active script panel to *.kql file |
Close Tab | Closes the current tab window |
---------Save Data--------- | |
To CSV | Exports data to a CSV (comma-separated-values) file |
To JSON | Exports data to a JSON formatted file |
To Excel | Exports data to an XLSX (Excel) file |
To Text | Exports data to a TXT (text) file |
To CSL Script | Exports Query to a script file |
To Results | Exports Query and data to a Results (QRES) file |
---------Load Data--------- | |
From Results | Loads Query and data from a Results (QRES) file |
---------Clipboard--------- | |
Data To Clipboard | Exports Query and data set to a clipboard. If a chart is presented, it exports the chart as a bitmap |
Result To Clipboard | Exports data set to a clipboard. If a chart is presented, it exports the chart as a bitmap |
Query to Clipboard | Exports the Query to clipboard |
---------Results--------- | |
Clear results cache | Clears cached results of previously executed queries |
Menu | Behavior |
---|---|
---------Groups--------- | |
Add group | Adds a new Kusto Server group |
Rename group | Renames the existing Kusto Server group |
Remove group | Removes the existing Kusto Server group |
---------Clusters--------- | |
Import connections | Imports connections from a file specifying connections |
Export connections | Exports connections to a file |
Add connection | Adds a new Kusto Server connection |
Edit connection | Opens a dialog for Kusto Server connection properties editing |
Remove connection | Removes the existing connection to Kusto Server |
Refresh | Refreshes properties of a Kusto server connection |
---------Identity Providers--------- | |
Inspect Connection Principal | Shows currents active user details |
Sign-out From AAD | Signs-out the current user from the connection to AAD |
---------Data Scope--------- | |
Caching scope |
|
DateTime Column | Name of column which may be used for time pre-filter |
Time Filter | Value of time pre-filter |
Menu | Behavior |
---|---|
---------Appearance--------- | |
Full View Mode | Maximizes the work space by hiding the ribbon menu and Connection Panel |
Increase Font | Increases the font size of the query tab and of the results data grid |
Decrease Font | Decreases the font size of the query tab and of the results data grid |
Reset Layout | Resets the layout of the tool's docking controls and windows |
---------Data View--------- | |
Reset View | Resets data view settings (*) |
Explore Column Values | Shows column values distribution |
Focus on query statistics | Changes the focus to query statistics instead of query results upon query completion |
Hide Duplicates | Toggles removal of the duplicate rows from the query results |
Hide Empty Columns | Toggles removal of empty columns from the query results |
Collapse Singular Columns | Toggles collapsing columns with singular value |
---------Data Filtering--------- | |
Filter Rows in Search | Toggles the option to show only matching rows in query results search (Ctrl+F) |
---------Visualizations--------- | |
Visualizations | See Visualizations, above. |
(*) Data View Settings: Kusto.Explorer keeps track of what settings are used per unique set of columns. So when columns are reordered or removed, the data view is saved and will be reused whenever the data with the same columns is retrieved. To reset the view to its defaults, in the View tab, select Reset View.
Menu | Behavior |
---|---|
---------IntelliSense--------- | |
Enable IntelliSense | Enables and disables IntelliSense on the Script Panel |
---------Analyze--------- | |
Query Analyzer | Launches the Query Analyzer tool |
Query Checker | Analyzes the current query and outputs a set of applicable improvement recommendations |
Calculator | Launches the calculator |
---------Analytics--------- | |
Analytical Reports | Opens a dashboard with multiple pre-built reports for data analysis |
---------Translate--------- | |
Query to Power BI | Translates a query to a format suitable for using in Power BI |
---------Options--------- | |
Reset Options | Sets application settings to default values |
Options | Opens a tool for configuring application settings. Details |
Menu | Behavior |
---|---|
---------Authorized Principals--------- | |
Manage Cluster Authorized Principals | Enables managing a cluster's principals for authorized users |
Manage Database Authorized Principals | Enables managing a database's principals for authorized users |
Manage Table Authorized Principals | Enables managing a table's principals for authorized users |
Manage Function Authorized Principals | Enables managing a function's principals for authorized users |
Menu | Behavior |
---|---|
---------Documentation--------- | |
Help | Opens a link to the Kusto online documentation |
What's new | Opens a document that lists all Kusto.Explorer changes |
Report Issue | Opens a dialog with two options:
|
Suggest Feature | Opens a link to the Kusto feedback forum |
Check Updates | Checks if there are updates to your version of Kusto.Explorer |
The left pane of Kusto.Explorer shows all the cluster connections that the clientis configured with. For each cluster it shows the databases, tables, and attributes (columns)that they store. The Connections panel enables you to select items (which sets an implicit contextfor the search/query in the main panel), or double-click items to copy the name to thesearch/query panel.
If the actual schema is large (such as a database with hundreds of tables), it's possible to search the schema by pressing CTRL+F and entering asubstring (case-insensitive) of the entity name you're looking for.
Kusto.Explorer supports controlling the Connection panel from the query window.This is very useful for scripts. For example, starting a script file with a commandthat instructs Kusto.Explorer to connect to the cluster/database whose data is beingqueried by the script is possible by using the following syntax. As usual, you'll have to run each line using F5
or similar:
When adding a new connection, the default security model used isAAD-Federated security, in which authentication is done through theAzure Active Directory using the default AAD user experience.
In some cases, you might need finer control over the authentication parametersthan is available in AAD. If so, it's possible to expand the'Advanced: Connection Strings' edit box and provide a validKusto connection string value.
For example, users who have presence inmultiple AAD tenants sometimes need to use a particular 'projection'of their identities to a specific AAD tenant. This can be done byproviding a connection string such as the one below (replace words IN CAPITAL with specific values):
What is unique is that AAD_TENANT_OF_CLUSTER
is a domain nameor AAD tenant ID (a GUID) of the AAD tenant in which the cluster is hosted(usually the organization domain name who owns the cluster, such ascontoso.com
), and USER_DOMAIN is the identity of the user invited into that tenant (for example, joe@fabrikam.com
).
Note
The domain name of the user is not necessarily the same as that of the tenant hosting the cluster.
Kusto.Explorer tries to 'guess' the severity or verbosity level of each row in the results pane and color it accordingly. It does this by matching the distinct values of each column with a set of known patterns ('Warning', 'Error', and so on).
To modify the output color scheme, or turn this behavior off, from the Tools menu, select Options > Results Viewer > Verbosity color scheme.
Kusto.Explorer has a powerful script mode which enables you to write, edit and run ad-hoc queries. The script mode comes with syntax highlighting and IntelliSense, so you can quickly ramp-up to Kusto CSL language.
If you have have table Logs, you can start exploring them by entering:
When your cursor is positioned on this line it's colored gray. Pressing 'F5' runs the query.
Here are some more example queries:
Kusto.Explorer provides a convenient way to upload a files from your machine to a Kusto table.
Make sure you created the table with a schema which matches your file(for example, using the .create table command)
Make sure the file extension is appropriate to the contents of the file. For example:
Right-click the target database in the Connections panel, and select Refresh, so that your table appears.
Right-click the target table in the Connections panel, and select Import data from local files.
Select the file(s) to upload and select Open.
The progress bar displays the progress, and a dialog displays when the operation completes
Query the data in your table (double-click the table in the Connections panel).
Kusto.Explorer provides a convenient way to manage cluster, database, table, or function authorized principals.
Note
Only admins can add or drop authorized principals in their own scope.
Right-click the target entity in the Connections panel, and select Manage Authorized Principals. (You can also do this from the Management Menu.)
To add a new authorized principal, select Add principal, provide the principal details, and confirm the action.
To drop an existing authorized principal, select Drop principal and confirm the action.
Kusto.Explorer provides a convenient way to share queries and query results by email. Select Export to Clipboard, and Kusto.Explorer will copy the following items to the clipboard:
Here's how it works:
Run a query in Kusto.Explorer
Select Export to Clipboard (or press Ctrl+Shift+C
)
Open, for example, a new Outlook message.
Paste the contents of the clipboard to the Outlook message.
Warning
There are two types of query parametrization techniques in Kusto:
Language-integrated query parametrization is implemented as partof the query engine and meant to be used by applications that query the service programmatically.
Client-side query parametrization, described below, is a feature of the Kusto.Explorer application only. It's equivalent to using string-replace operations on the queries before sending them to be executed by the service. The syntax described below is not part of the query language itself, and can't be used when sending queries to the service by means other than Kusto.Explorer.
If you plan to use same value in multiple queries or in multiple tabs, it's going to be difficult to change it. However, Kusto.Explorer supports Query parameters. Parameters are denoted by {} brackets. For example: {parameter1}
The script editor highlights query parameters:
You can easily define and edit existing query parameters:
The script editor also has IntelliSense for query parameters that are already defined:
There can be multiple sets of parameters (listed in the Parameters Set combo box).Use the Add new and Delete current to manipulate the list of Parameter sets.
Query parameters are shared among tabs, so that they can be easily reused.
You can create a URI that, when opened in a browser, Kusto.Explorer will start locally and run a specific query on a specified Kusto database.
The queries are limited to ~2000 characters due to Internet Explorer limitations (the limitation is approximate because it's dependent on the cluster and Database name length)https://support.microsoft.com/kb/208427To reduce chances you will reach the character limit, see Getting Shorter Links, below.
The format of the URI is:https://
For example: https://help.kusto.windows.net/Samples?query=StormEvents+%7c+limit+10
This URI will open Kusto.Explorer, connect to the help
Kusto cluster, and run the specified query on the Samples
database. If there is an instance of Kusto.Explorer already running, the running instance will open a new tab and run the query in it.)
Security note: For security reasons, deep-linking is disabled for control commands.
The easiest way to create a deep-link is to author your query in Kusto.Explorer and then useExport to Clipboard to copy the query (including the deep link and results) to the clipboard. You can then share it by email.
When copied to an email, the deep link is displayed in small fonts; for example:
https://help.kusto.windows.net:443/Samples [Click to run query]
The first link opens Kusto.Explorer and sets the cluster and database context appropriately.The second link (Click to run query) is the deep link. If you move to the link to an email messageand press CTRL-K, you can see the actual URL:
You can use Parametrized Queries with deep-linking.
KustoLogs where Timestamp > ago({Period}) count
)Queries can become long. To reduce the chance the query exceeds the maximum length use theString Kusto.Data.Common.CslCommandGenerator.EncodeQueryAsBase64Url(string query)
methodavailable in Kusto Client Library. This method produces a more compact version of the query. The shorter format is also recognized by Kusto.Explorer.
The query is made more compact by applying next transformation:
Kusto.Explorer supports several command-line arguments in the following syntax (the order matters):
[LocalScriptFile] [QueryString]
Where:
.kql
. If such a file exists, Kusto.Explorer automaticallyloads this file when it starts up.For example, to start Kusto.Explorer with a script file called c:tempscript.kql
and configured to communicate with cluster help
, database Samples
, use thefollowing command:
Argument | Description |
---|---|
Query to execute | |
query | The query to execute (base64-encoded). If empty, use querysrc . |
querysrc | The URL of a file or blob holding the query to execute (if query is empty). |
Connection to the Kusto cluster | |
uri | The connection string of the Kusto cluster to connect to. |
name | The display name of the connection to the Kusto cluster. |
Connection group | |
path | The URL of a connection group file to download (URL-encoded). |
group | The name of the connection group. |
filename | The local file holding the connection group. |
Kusto.Explorer keeps its connections settings in the %LOCALAPPDATA%Kusto.Explorer
folder.A list of Connection Groups is kept inside %LOCALAPPDATA%Kusto.ExplorerUserConnectionGroups.xml
,and each Connection Group is kept inside a dedicated file under %LOCALAPPDATA%Kusto.ExplorerConnections
.
The file location is %LOCALAPPDATA%Kusto.ExplorerUserConnectionGroups.xml
.
This is an XML serialization of an array of the ServerGroupDescription
objects with the following properties:
Example:
File location is: %LOCALAPPDATA%Kusto.ExplorerConnections
.
This is an XML serialization of an array of the ServerDescriptionBase
objects with the following properties:
Example:
If you need to, you can completely reset Kusto.Explorer. Use the following procedure to progressively reset Kusto.Explorer deployed on your computer, until it's completely removed and must be installed from scratch.
In Windows, open Change or remove a programs (also known as Programs and Features).
Select every item whose name starts with Kusto.Explorer
.
Select Uninstall.
If this fails to uninstall the application (a known issue sometimes withClickOnce applications), see this stack overflow article which explains how to do it.
Delete the folder %LOCALAPPDATA%Kusto.Explorer
. This removes all connections, history, and so on.
Delete the folder %APPDATA%Kusto
. This removes the Kusto.Explorer token cache. You will need to re-authenticate to all clusters.
It's also possible to revert to a specific version of Kusto.Explorer:
appwiz.cpl
.Symptom:
At start-up, Kusto.Explorer shows an InvalidOperationException
error.
Possible solution:
This error may suggest that the operating system became corrupted or is missing some of the essential modules.To check missing or corrupted system files, follow the steps described here:
https://support.microsoft.com/help/929833/use-the-system-file-checker-tool-to-repair-missing-or-corrupted-system
Symptom:
Every time you open Kusto.Explorer, you are prompted to install a new verison. Kusto.Explorer downloads the entire package, without actually updating the already-installed version.
Possible solution:
This could be a result of corruption in your local ClickOnce store. You can clear the local ClickOnce store, by running the following command, in an elevated command prompt.
Important
dfsvc.exe
, terminate them before running this command.Try installing Kusto.Explorer again from one of the installation mirrors.
Symptoms:
External component has thrown an exception
Value does not fall within the expected range
The application binding data format is invalid.
Exception from HRESULT: 0x800736B2
You can explore the error details by clicking Details
in the following error dialog:
Proposed solution steps:
Uninstall the Kusto.Explorer application using Programs and Features
(appwiz.cpl
).
Try running CleanOnlineAppCache
, and then try installing Kusto.Explorer again. From an elevated command-prompt:
Install Kusto.Explorer again from one of the installation mirrors.
If it still fails, delete the local ClickOnce store. Any ClickOnce apps will reinstall automatically the next time you run them, as long as you have access to the original install location stored in the app shortcut. App shortcuts would not be deleted.
From an elevated command-prompt:
If it still fails, remove temp deployment files and rename the Kusto.Explorer local AppData folder.
From an elevated command-prompt:
Install Kusto.Explorer again from one of the installation mirrors
To restore your connections from Kusto.Explorer.bak, from an elevated command-prompt:
If it still fails, enable verbose ClickOnce logging by creating a LogVerbosityLevel string value of 1 under:
HKEY_CURRENT_USERSoftwareClassesSoftwareMicrosoftWindowsCurrentVersionDeployment
, repro it again, and send the verbose output to KEBugReport@microsoft.com.
Symptom:
Program fails to install with either of the following errors:
Your administrator has blocked this application because it potentially poses a security risk to your computer
.Your security settings do not allow this application to be installed on your computer.
Solution:
Sometimes, when previous troubleshooting steps didn't help with getting Kusto.Explorer to start, cleaning data stored locally may help.
Data stored by Kusto.Explorer application can be found here: C:Users[your alias]AppDataLocalKusto.Explorer
.
Note
Cleaning the data will lead to loss of opened tabs (Recovery folder), saved connections (Connections folder), and application settings (UserSettings folder).