diff --git a/data-explorer/kusto/docs-navigation.md b/data-explorer/kusto/docs-navigation.md index 25c306f856..5601fd7874 100644 --- a/data-explorer/kusto/docs-navigation.md +++ b/data-explorer/kusto/docs-navigation.md @@ -2,38 +2,37 @@ title: KQL docs navigation guide description: Learn how to understand which version of KQL documentation you are viewing and how to switch to a different version. ms.topic: conceptual -ms.date: 08/14/2024 +ms.date: 09/15/2025 --- # KQL docs navigation guide > [!INCLUDE [applies](includes/applies-to-version/applies.md)] [!INCLUDE [fabric](includes/applies-to-version/fabric.md)] [!INCLUDE [azure-data-explorer](includes/applies-to-version/azure-data-explorer.md)] [!INCLUDE [monitor](includes/applies-to-version/monitor.md)] [!INCLUDE [sentinel](includes/applies-to-version/sentinel.md)] - -The behavior of KQL may vary when using this language in different services. When you view any KQL documentation article by using our Learn website, the currently chosen service name is visible above the table of contents (TOC) under the **Version** dropdown. Switch between services using the version dropdown to see the KQL behavior for the selected service. +KQL behavior can vary across services. On Microsoft Learn, the selected service name appears above the table of contents (TOC) under the **Version** dropdown. To view behavior for another service, use the **Version** dropdown to switch services. ## Change service selection -If you want to see the documentation for a different version of KQL, select the expander arrow located at the end of the current version moniker. Then select any service you want. When you select a different service, the displayed documentation suddenly changes to show the differences for the newly chosen version. There might or might not be any changes, and both cases are common. +To view documentation for another KQL version, select the expander arrow at the end of the current version moniker, then select a service. The page updates to show any differences for that version. Some services have no differences, so the content might not change. -:::image type="content" source="media/docs-navigation/version.gif" alt-text="Screen capture of selecting a different version in the TOC."::: +:::image type="content" source="media/docs-navigation/version.gif" alt-text="Screenshot of selecting a different KQL version from the table of contents."::: -## HTTPS parameter view= +## HTTPS view= parameter -Each article whose web address begins with `https://learn.microsoft.com/kusto/` has a parameter named `?view=` appended to its address. This parameter value is the versioning moniker code. +Articles at `https://learn.microsoft.com/kusto/` include a `?view=` parameter. The parameter value is the versioning moniker code. -The moniker code in the https address always matches the moniker name that is displayed in the versioning control. +The moniker code in the HTTPS address always matches the moniker name displayed in the versioning control. ## Applies to services -Most of the KQL articles have the words **Applies to** under their title. On the same line, there follows a handy listing of services with indicators of which services are relevant for this article. For example, a certain function could be applicable to Fabric and Azure Data Explorer, but not Azure Monitor or others. If you do not see the service you are using, most likely the article is not relevant to your service. +Most KQL articles include **Applies to** under the title. The line lists services and shows which ones the article applies to. For example, a function might apply to Microsoft Fabric and Azure Data Explorer, but not to Azure Monitor. If you don't see your service, the article likely doesn't apply. ## Versions -The following table describes the different versions of KQL and the services they are associated with. +This table describes KQL versions and their associated services. | Version | Description | |---|---| -| Microsoft Fabric | [Microsoft Fabric](/fabric/get-started/microsoft-fabric-overview) is an end-to-end analytics and data platform designed for enterprises that require a unified solution. It encompasses data movement, processing, ingestion, transformation, real-time event routing, and report building. Within the suite of experiences offered in Microsof Fabric, [Real-Time Intelligence](/fabric/real-time-intelligence/overview) is a powerful service that empowers everyone in your organization to extract insights and visualize their data in motion. It offers an end-to-end solution for event-driven scenarios, streaming data, and data logs.

The main query environment for KQL in Microsoft Fabric is the [KQL queryset](/fabric/real-time-intelligence/kusto-query-set).

KQL in Microsoft Fabric supports query operators, functions, and management commands. | -| Azure Data Explorer | [Azure Data Explorer](/azure/data-explorer/data-explorer-overview) is a fully managed, high-performance, big data analytics platform that makes it easy to analyze high volumes of data in near real time. There are several [query environments and integrations](/azure/data-explorer/integrate-query-overview) that can be used in Azure Data Explorer, including the [web UI](/azure/data-explorer/web-ui-query-overview).

KQL in Azure Data Explorer is the full, native version, which supports all query operators, functions, and management commands.| -| Azure Monitor | [Log Analytics](/azure/azure-monitor/logs/log-analytics-overview) is a tool in the Azure portal that's used to edit and run log queries against data in the [Azure Monitor](/azure/azure-monitor/overview) Logs store. You interact with Log Anlytics in a [Log Analytics workspace in the Azure portal](/azure/azure-monitor/logs/log-analytics-overview#log-analytics-interface).

KQL in Azure Monitor uses a subset of the overall KQL operators and functions. | -| Microsoft Sentinel | [Microsoft Sentinel](/azure/sentinel/overview) is a scalable, cloud-native security information and event management (SIEM) that delivers an intelligent and comprehensive solution for SIEM and security orchestration, automation, and response (SOAR). Microsoft Sentinel provides cyberthreat detection, investigation, response, and proactive hunting, with a bird's-eye view across your enterprise. Microsoft Sentinel is built on top of the Azure Monitor service and it uses Azure Monitor's Log Analytics workspaces to store all of its data.

KQL in Microsoft Sentinel uses a subset of the overall KQL operators and functions. | +| Microsoft Fabric | [Microsoft Fabric](/fabric/get-started/microsoft-fabric-overview) is an end-to-end analytics and data platform for enterprises that need a unified solution. It covers data movement, processing, ingestion, transformation, real-time event routing, and report building. Within the suite of experiences in Microsoft Fabric, [Real-Time Intelligence](/fabric/real-time-intelligence/overview) lets everyone in your organization extract insights and visualize streaming data. It provides an end-to-end solution for event-driven scenarios, streaming data, and data logs.

The main query environment for KQL in Microsoft Fabric is the [KQL queryset](/fabric/real-time-intelligence/kusto-query-set).

KQL in Microsoft Fabric supports query operators, functions, and management commands. | +| Azure Data Explorer | [Azure Data Explorer](/azure/data-explorer/data-explorer-overview) is a fully managed, high-performance analytics platform for near real-time analysis of large data volumes. Use several [query environments and integrations](/azure/data-explorer/integrate-query-overview), including the [web UI](/azure/data-explorer/web-ui-query-overview).

KQL in Azure Data Explorer is the full native version. It supports all query operators, functions, and management commands.| +| Azure Monitor | [Log Analytics](/azure/azure-monitor/logs/log-analytics-overview) is a tool in the Azure portal you use to edit and run log queries against data in the [Azure Monitor](/azure/azure-monitor/overview) Logs store. Use Log Analytics in a [Log Analytics workspace in the Azure portal](/azure/azure-monitor/logs/log-analytics-overview#log-analytics-interface).

KQL in Azure Monitor uses a subset of KQL operators and functions. | +| Microsoft Sentinel | [Microsoft Sentinel](/azure/sentinel/overview) is a scalable, cloud-native security information and event management (SIEM) platform with security orchestration, automation, and response (SOAR). It provides threat detection, investigation, response, and proactive hunting across your enterprise. It uses Azure Monitor Log Analytics workspaces to store its data.

KQL in Microsoft Sentinel uses a subset of KQL operators and functions. | diff --git a/data-explorer/kusto/index.yml b/data-explorer/kusto/index.yml index d740a7e212..a9716f176c 100644 --- a/data-explorer/kusto/index.yml +++ b/data-explorer/kusto/index.yml @@ -10,7 +10,7 @@ metadata: ms.topic: landing-page author: spelluru ms.author: spelluru - ms.date: 08/11/2024 + ms.date: 09/15/2025 # linkListType: architecture | concept | deploy | download | get-started | how-to-guide | learn | overview | quickstart | reference | sample | tutorial | video | whats-new diff --git a/data-explorer/kusto/media/set-timeouts/kusto-explorer-set-timeouts.png b/data-explorer/kusto/media/set-timeouts/kusto-explorer-set-timeouts.png index 8290ea5155..033685fb94 100644 Binary files a/data-explorer/kusto/media/set-timeouts/kusto-explorer-set-timeouts.png and b/data-explorer/kusto/media/set-timeouts/kusto-explorer-set-timeouts.png differ diff --git a/data-explorer/kusto/media/set-timeouts/web-ui-set-timeouts.png b/data-explorer/kusto/media/set-timeouts/web-ui-set-timeouts.png index 90b903f2dd..16249316d0 100644 Binary files a/data-explorer/kusto/media/set-timeouts/web-ui-set-timeouts.png and b/data-explorer/kusto/media/set-timeouts/web-ui-set-timeouts.png differ diff --git a/data-explorer/kusto/query/kql-learning-resources.md b/data-explorer/kusto/query/kql-learning-resources.md index b9acc87f16..26a46fa173 100644 --- a/data-explorer/kusto/query/kql-learning-resources.md +++ b/data-explorer/kusto/query/kql-learning-resources.md @@ -1,44 +1,45 @@ --- -title: Kusto Query Language learning resources -description: This article provides a list of various learning resources to help you ramp up on Kusto Query Language (KQL) effectively. +title: Kusto Query Language Learning Resources +description: Learn KQL from scratch with curated resources, including tutorials, demos, and training programs for data analysts and professionals. ms.reviewer: alexans ms.topic: concept-article -ms.date: 08/11/2024 +ms.date: 09/15/2025 #customerIntent: As a data analyst, I want to access various learning resources for Kusto Query Language (KQL), so that I can effectively explore and analyze data using KQL. --- + # Kusto Query Language learning resources > [!INCLUDE [applies](../includes/applies-to-version/applies.md)] [!INCLUDE [fabric](../includes/applies-to-version/fabric.md)] [!INCLUDE [azure-data-explorer](../includes/applies-to-version/azure-data-explorer.md)] [!INCLUDE [monitor](../includes/applies-to-version/monitor.md)] [!INCLUDE [sentinel](../includes/applies-to-version/sentinel.md)] -Kusto Query Language (KQL) is a powerful tool to explore your data and discover patterns, identify anomalies and outliers, create statistical modeling, and more. Are you new to KQL or want to improve your KQL skills? Take a look at the following learning resources. +Use Kusto Query Language (KQL) to explore your data, discover patterns, identify anomalies and outliers, build statistical models, and more. New to KQL or want to improve your skills? Use the following learning resources. -For more information on KQL, see [KQL overview](index.md). +For more information, see [KQL overview](index.md). -::: moniker range="microsoft-sentinel || azure-monitor" +:::moniker range="microsoft-sentinel || azure-monitor" ## Demo environment -You can practice Kusto Query Language statements in a [Log Analytics demo environment](https://aka.ms/lademo) in the Azure portal. There's no charge to use this practice environment, but you do need an Azure account to access it. +Practice Kusto Query Language statements in the [Log Analytics demo environment](https://aka.ms/lademo) in the Azure portal. It's free, but you need an Azure account. -Like Log Analytics in your production environment, it can be used in many ways: +Like your production Log Analytics workspace, the demo environment lets you: -* **Choose a table on which to build a query.** From the default **Tables** tab (shown in the red rectangle at the upper left), select a table from the list of tables grouped by topics (shown at the lower left). Expand the topics to see the individual tables, and you can further expand each table to see all its fields (columns). Double-clicking on a table or a field name places it at the point of the cursor in the query window. Type the rest of your query following the table name, as directed below. +* **Choose a table on which to build a query.** From the **Tables** tab, select a table from the list grouped by topic. Expand a topic to see its tables. Expand a table to see its fields (columns). Double-click a table or field name to insert it at the cursor in the query window. Type the rest of the query after the table name. -* **Find an existing query to study or modify.** Select the **Queries** tab (shown in the red rectangle at the upper left) to see a list of queries available out-of-the-box. Or, select **Queries** from the button bar at the top right. Double-click a query to place it in the query window at the point of the cursor. +* **Find an existing query to study or modify.** Select the **Queries** tab to see the list of queries available by default. Alternatively, select **Queries** from the button bar. Double-click a query to insert it at the cursor in the query window. ::: moniker-end ::: moniker range="microsoft-sentinel" -Like in this demo environment, you can query and filter data in the Microsoft Sentinel **Logs** page. You can select a table and drill down to see columns. You can modify the default columns shown using the **Column chooser**, and you can set the default time range for queries. If the time range is explicitly defined in the query, the time filter is unavailable (grayed out). +As in the demo environment, query and filter data on the Microsoft Sentinel **Logs** page. Select a table and drill down to see its columns. Use the **Column chooser** to modify the default columns, and set the default time range for queries. If the time range is explicitly defined in the query, the time filter is unavailable (grayed out). -If Microsoft Sentinel is [onboarded to the Defender portal](/azure/sentinel/microsoft-sentinel-defender-portal), you can also query and filter data in the Microsoft Defender **Advanced hunting** page. For more information, see [Advanced hunting with Microsoft Sentinel data in Microsoft Defender portal](/defender-xdr/advanced-hunting-microsoft-defender?toc=%2Fazure%2Fsentinel%2FTOC.json&bc=%2Fazure%2Fsentinel%2Fbreadcrumb%2Ftoc.json&branch=main). +If Microsoft Sentinel is [onboarded to the Defender portal](/azure/sentinel/microsoft-sentinel-defender-portal), query and filter data on the Microsoft Defender **Advanced hunting** page. For more information, see [Advanced hunting with Microsoft Sentinel data in Microsoft Defender portal](/defender-xdr/advanced-hunting-microsoft-defender?toc=%2Fazure%2Fsentinel%2FTOC.json&bc=%2Fazure%2Fsentinel%2Fbreadcrumb%2Ftoc.json&branch=main). ::: moniker-end -## General training +## KQL training -For general information about KQL, see: +Learn more about KQL: * [Pluralsight: KQL from scratch](https://www.pluralsight.com/courses/kusto-query-language-kql-from-scratch) * [Kusto Detective Agency](https://detective.kusto.io/) diff --git a/data-explorer/kusto/query/kql-quick-reference.md b/data-explorer/kusto/query/kql-quick-reference.md index 5d4b4c5055..b652bf2027 100644 --- a/data-explorer/kusto/query/kql-quick-reference.md +++ b/data-explorer/kusto/query/kql-quick-reference.md @@ -1,9 +1,9 @@ --- -title: KQL quick reference -description: A list of useful KQL functions and their definitions with syntax examples. +title: KQL Quick Reference +description: Learn how to use KQL functions like `where`, `summarize`, and `render` with syntax examples to streamline your data queries. ms.reviewer: ms.topic: conceptual -ms.date: 08/11/2024 +ms.date: 09/15/2025 adobe-target: true --- diff --git a/data-explorer/kusto/query/media/kql-tutorials/crop-damage-by-week-time-chart.png b/data-explorer/kusto/query/media/kql-tutorials/crop-damage-by-week-time-chart.png index a60f9ab142..30cf11657c 100644 Binary files a/data-explorer/kusto/query/media/kql-tutorials/crop-damage-by-week-time-chart.png and b/data-explorer/kusto/query/media/kql-tutorials/crop-damage-by-week-time-chart.png differ diff --git a/data-explorer/kusto/query/media/kql-tutorials/damage-per-capita-chart.png b/data-explorer/kusto/query/media/kql-tutorials/damage-per-capita-chart.png index 77a2f1acb1..592528f449 100644 Binary files a/data-explorer/kusto/query/media/kql-tutorials/damage-per-capita-chart.png and b/data-explorer/kusto/query/media/kql-tutorials/damage-per-capita-chart.png differ diff --git a/data-explorer/kusto/query/media/kql-tutorials/injuries-bucket-pie-chart.png b/data-explorer/kusto/query/media/kql-tutorials/injuries-bucket-pie-chart.png index fea37ade97..21750f291f 100644 Binary files a/data-explorer/kusto/query/media/kql-tutorials/injuries-bucket-pie-chart.png and b/data-explorer/kusto/query/media/kql-tutorials/injuries-bucket-pie-chart.png differ diff --git a/data-explorer/kusto/query/media/kql-tutorials/total-storms-by-state-bar-chart.png b/data-explorer/kusto/query/media/kql-tutorials/total-storms-by-state-bar-chart.png index 88844104c0..627c4ec5e5 100644 Binary files a/data-explorer/kusto/query/media/kql-tutorials/total-storms-by-state-bar-chart.png and b/data-explorer/kusto/query/media/kql-tutorials/total-storms-by-state-bar-chart.png differ diff --git a/data-explorer/kusto/query/tutorials/join-data-from-multiple-tables.md b/data-explorer/kusto/query/tutorials/join-data-from-multiple-tables.md index 858c302ce3..6b33cba2af 100644 --- a/data-explorer/kusto/query/tutorials/join-data-from-multiple-tables.md +++ b/data-explorer/kusto/query/tutorials/join-data-from-multiple-tables.md @@ -1,18 +1,18 @@ --- -title: 'Tutorial: Join data from multiple tables' +title: 'Tutorial: Join Data from Multiple Tables' description: This tutorial shows how to join data from multiple tables using the Kusto Query Language. ms.topic: tutorial -ms.date: 08/11/2024 +ms.date: 09/15/2025 monikerRange: "microsoft-fabric || azure-data-explorer || microsoft-sentinel || azure-monitor" --- -# Tutorial: Join data from multiple tables +# Tutorial: join data from multiple tables > [!INCLUDE [applies](../../includes/applies-to-version/applies.md)] [!INCLUDE [fabric](../../includes/applies-to-version/fabric.md)] [!INCLUDE [azure-data-explorer](../../includes/applies-to-version/azure-data-explorer.md)] [!INCLUDE [monitor](../../includes/applies-to-version/monitor.md)] [!INCLUDE [sentinel](../../includes/applies-to-version/sentinel.md)] -Joining data from multiple tables allows for a more comprehensive analysis by combining information from different sources and creating new relationships between data points. In the [Kusto Query Language (KQL)](../index.md), the [join](../join-operator.md) and [lookup](../lookup-operator.md) operators are used to combine data across tables. +Joining data from multiple tables lets you analyze data across sources and create relationships between data points. In the [Kusto Query Language (KQL)](../index.md), use the [join](../join-operator.md) and [lookup](../lookup-operator.md) operators to combine data across tables. -In this tutorial, you'll learn how to: +In this tutorial, you learn how to: > [!div class="checklist"] > @@ -30,19 +30,19 @@ The examples in this tutorial use the `StormEvents` table, which is publicly ava ## Prerequisites -To run the following queries, you need a query environment with access to the sample data. You can use one of the following: +Run the queries in a query environment that has access to the sample data. Use one of the following: :::moniker range="azure-data-explorer" -* A Microsoft account or Microsoft Entra user identity to sign in to the [help cluster](https://dataexplorer.azure.com/clusters/help) +* Microsoft account or Microsoft Entra user identity to sign in to the [help cluster](https://dataexplorer.azure.com/clusters/help) ::: moniker-end :::moniker range="microsoft-fabric" * A Microsoft account or Microsoft Entra user identity -* A [Fabric workspace](/fabric/get-started/create-workspaces) with a Microsoft Fabric-enabled [capacity](/fabric/enterprise/licenses#capacity) +* [Fabric workspace](/fabric/get-started/create-workspaces) with a Microsoft Fabric-enabled [capacity](/fabric/enterprise/licenses#capacity) ::: moniker-end ## Use the join operator -There are two tables in the [Samples database](https://dataexplorer.azure.com/clusters/help/databases/Samples) related to storm events. One is called `StormEvents` and the other is called `PopulationData`. In this section, you'll join the tables to perform data analysis that wouldn't be possible with one table alone. +The [Samples database](https://dataexplorer.azure.com/clusters/help/databases/Samples) has two related storm event tables: `StormEvents` and `PopulationData`. In this section, you join them to analyze data that's not possible with one table alone. ### Understand the data @@ -58,7 +58,7 @@ StormEvents | take 5 ``` -The following table shows only 6 of the 22 returned columns. +The following table shows only six of the 22 returned columns. |StartTime|EndTime|EpisodeId|EventId|State|EventType|...| |--|--|--|--|--|--|--| @@ -88,11 +88,11 @@ PopulationData |ARKANSAS|3025880| |CALIFORNIA|39562900| -Both tables contain a `State` column. The `StormEvents` table has many more columns, and the `PopulationData` has only one other column that contains the population of the given state. +Both tables have a `State` column. `StormEvents` has many more columns, and `PopulationData` has one other column with the state's population. ### Join the tables -Join the `PopulationData` table with `StormEvents` on the common `State` column to find the total property damage caused by storms per capita by state. +Join `PopulationData` with `StormEvents` on `State` to calculate total property damage per capita by state. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] @@ -116,23 +116,23 @@ Add `| render columnchart` to the query to visualize the result. :::image type="content" source="../media/kql-tutorials/damage-per-capita-chart.png" alt-text="Screenshot of column chart showing property damage per capita by state."::: -If the columns have different names, for example `StormEvents` has `State` and `PopulationData` has `StateName`, specify the join as follows: +If the columns have different names (for example, `StormEvents` has `State` and `PopulationData` has `StateName`), specify the join as: -```kusto +```kusto StormEvents | join kind=innerunique PopulationData on $left.State == $right.StateName ``` -`$left` is the table on the left, or outer side of the join operator, in this case `StormEvents`. `$right` is the table on the right, or inner side of the join operator, in this case `PopulationData`. +`$left` refers to the left (outer) table in the join: `StormEvents`. `$right` refers to the right (inner) table: `PopulationData`. > [!TIP] -> There are many types of joins that you can perform with the `join` operator. See a [list of join flavors](../join-operator.md#returns). +> Use the `join` operator for many join types. See the [list of join flavors](../join-operator.md#returns). ## Use the lookup operator -The [lookup](../lookup-operator.md) operator optimizes the performance of queries where a fact table is enriched with data from a dimension table. It extends the fact table with values that are looked up in a dimension table. For best performance, the system by default assumes that the left table is the larger fact table, and the right table is the smaller dimension table. This is exactly opposite to the assumption that's used by the `join` operator. +The [lookup](../lookup-operator.md) operator optimizes queries that enrich a fact table with data from a dimension table. It extends the fact table with values from the dimension table. By default, the system assumes the left table is the larger fact table and the right table is the smaller dimension table. This default is the opposite of the `join` operator's assumption. -In the help cluster, there's another database called `ContosoSales` that contains sales data. The following query uses `lookup` to merge the `SalesFact` and `Products` tables from this database to get the total sales by product category. +The help cluster includes a database named `ContosoSales` with sales data. The following query uses `lookup` to merge the `SalesFact` and `Products` tables to return total sales by product category. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] @@ -152,7 +152,7 @@ SalesFact |--|--| |Games and Toys|966782| |TV and Video|715024| -|Cameras and camcorders |323003| +|Cameras and camcorders|323003| |Computers|313487| |Home Appliances|237508| |Audio|192671| @@ -160,13 +160,13 @@ SalesFact |Music, Movies and Audio Books|33376| > [!NOTE] -> The `lookup` operator only supports two join flavors: `leftouter` and `inner`. +> The `lookup` operator supports only two join flavors: `leftouter` and `inner`. ## Join query-generated tables -Joins can also be done based on query results from the same table. +Join results from the same table. -Say you want to create a list of states in which both lightning and avalanche events occurred. Use the join operator to merge the rows of two tables—one containing data on lightning events and the other containing data on avalanche events—based on the `State` column. +Suppose you want a list of states that have both lightning and avalanche events. Use the join operator to merge rows from two queries that return distinct states for each event type on the `State` column. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] @@ -199,6 +199,6 @@ StormEvents |NEVADA| ## Related content -* Learn about different kinds of [join-operator](../join-operator.md) -* Learn how to perform [cross-database and cross-cluster queries](../cross-cluster-or-database-queries.md) -* Follow the [create geospatial visualizations](create-geospatial-visualizations.md) tutorial +* Learn about different kinds of [join operator](../join-operator.md). +* Perform [cross-database and cross-cluster queries](../cross-cluster-or-database-queries.md). +* Follow the [Create geospatial visualizations](create-geospatial-visualizations.md) tutorial. diff --git a/data-explorer/kusto/query/tutorials/use-aggregation-functions.md b/data-explorer/kusto/query/tutorials/use-aggregation-functions.md index e5f383016a..13934bd89e 100644 --- a/data-explorer/kusto/query/tutorials/use-aggregation-functions.md +++ b/data-explorer/kusto/query/tutorials/use-aggregation-functions.md @@ -1,8 +1,8 @@ --- title: 'Tutorial: Use aggregation functions in Kusto Query Language' -description: This tutorial describes how to use aggregation functions in the Kusto Query Language. +description: Learn how to use aggregation functions in Kusto Query Language (KQL) to summarize and analyze data effectively in this step-by-step tutorial. ms.topic: tutorial -ms.date: 08/11/2024 +ms.date: 09/15/2025 --- # Tutorial: Use aggregation functions @@ -25,7 +25,6 @@ In this tutorial, you'll learn how to: > * [Bucket data by condition](#bucket-data-by-condition) > * [Perform aggregation over a sliding window](#perform-aggregations-over-a-sliding-window) - ::: moniker range="azure-data-explorer" The examples in this tutorial use the `StormEvents` table, which is publicly available in the [**help** cluster](https://help.kusto.windows.net/Samples). To explore with your own data, [create your own free cluster](/azure/data-explorer/start-for-free-web-ui). ::: moniker-end @@ -36,6 +35,7 @@ The examples in this tutorial use the `StormEvents` table, which is publicly ava This tutorial builds on the foundation from the first tutorial, [Learn common operators](learn-common-operators.md). ## Prerequisites + To run the following queries, you need a query environment with access to the sample data. You can use one of the following: :::moniker range="azure-data-explorer" * A Microsoft account or Microsoft Entra user identity to sign in to the [help cluster](https://dataexplorer.azure.com/clusters/help) @@ -90,7 +90,7 @@ StormEvents | render barchart ``` -:::image type="content" source="../media/kql-tutorials/total-storms-by-state-bar-chart.png" alt-text="Screenshot of total storms by state bar chart created with the render operator."::: +:::image type="content" source="../media/kql-tutorials/total-storms-by-state-bar-chart.png" alt-text="Screenshot of total storms by state bar chart created with the render operator." lightbox="../media/kql-tutorials/total-storms-by-state-bar-chart.png"::: ## Conditionally count rows @@ -155,7 +155,7 @@ Add `| render timechart` to the end of the query to visualize the results. > Run the query ::: moniker-end -:::image type="content" source="../media/kql-tutorials/crop-damage-by-week-time-chart.png" alt-text="Screenshot of the crop damage by week time chart rendered by the previous query."::: +:::image type="content" source="../media/kql-tutorials/crop-damage-by-week-time-chart.png" alt-text="Screenshot of the crop damage by week time chart rendered by the previous query." lightbox="../media/kql-tutorials/crop-damage-by-week-time-chart.png"::: > [!NOTE] > `bin()` is similar to the `floor()` function in other programming languages. It reduces every value to the nearest multiple of the modulus that you supply and allows `summarize` to assign the rows to groups. @@ -210,7 +210,7 @@ StormEvents | render timechart ``` -:::image type="content" source="../media/kql-tutorials/sum-crop-damage-by-week.png" alt-text="Screenshot of time chart showing crop damage by week."::: +:::image type="content" source="../media/kql-tutorials/sum-crop-damage-by-week.png" alt-text="Screenshot of time chart showing crop damage by week." lightbox="../media/kql-tutorials/sum-crop-damage-by-week.png"::: Now you can see a peak in crop damage in January, which probably was due to Frost/Freeze. @@ -256,7 +256,6 @@ StormEvents |MISSOURI|2016|78|3.87| |...|...|...|...| - > [!NOTE] > When calculating percentages, convert at least one of the integer values in the division with [todouble() or toreal()](../toreal-function.md). This will ensure that you don't get truncated results due to integer division. For more information, see [Type rules for arithmetic operations](../numerical-operators.md#type-rules-for-arithmetic-operations). @@ -380,7 +379,7 @@ StormEvents | render piechart ``` -:::image type="content" source="../media/kql-tutorials/injuries-bucket-pie-chart.png" alt-text="Screenshot of web UI pie chart rendered by the previous query."::: +:::image type="content" source="../media/kql-tutorials/injuries-bucket-pie-chart.png" alt-text="Screenshot of web UI pie chart rendered by the previous query." lightbox="../media/kql-tutorials/injuries-bucket-pie-chart.png"::: ## Perform aggregations over a sliding window diff --git a/data-explorer/kusto/set-timeout-limits.md b/data-explorer/kusto/set-timeout-limits.md index 0cc809f867..ba092af2a6 100644 --- a/data-explorer/kusto/set-timeout-limits.md +++ b/data-explorer/kusto/set-timeout-limits.md @@ -45,7 +45,7 @@ This section describes how to configure a custom query timeout and admin command ### Prerequisites -* Download and install the [Kusto.Explorer tool](tools/kusto-explorer.md#installing-kustoexplorer). +* Download and install the [Kusto.Explorer tool](tools/kusto-explorer.md#install-kustoexplorer). * An Azure Data Explorer cluster and database. [Create a cluster and database](/azure/data-explorer/create-cluster-and-database). ### Set timeout length diff --git a/data-explorer/kusto/tools/kusto-explorer-troubleshooting.md b/data-explorer/kusto/tools/kusto-explorer-troubleshooting.md index 0400e5c162..b14050231d 100644 --- a/data-explorer/kusto/tools/kusto-explorer-troubleshooting.md +++ b/data-explorer/kusto/tools/kusto-explorer-troubleshooting.md @@ -37,20 +37,22 @@ Every time you open Kusto.Explorer, you're prompted to install a new version. Ku This symptom could be a result of corruption in your local ClickOnce store. You can clear the local ClickOnce store, by running the following command, in an elevated command prompt. > [!IMPORTANT] +> > 1. If there are any other instances of ClickOnce applications or of `dfsvc.exe`, terminate them before running this command. -> 1. All ClickOnce apps will reinstall automatically the next time you run them, as long as you have access to the original install location stored in the app shortcut. App shortcuts won't be deleted. +> 1. All ClickOnce apps will reinstall automatically the next time you run them, as long as you have access to the original install location stored in the app shortcut. App shortcuts aren't deleted. ```kusto rd /q /s %userprofile%\appdata\local\apps\2.0 ``` -Try installing Kusto.Explorer again from one of the [installation mirrors](kusto-explorer.md#installing-kustoexplorer). +Try installing Kusto.Explorer again from one of the [installation mirrors](kusto-explorer.md#install-kustoexplorer). ### ClickOnce error: Cannot Start Application #### Symptoms -The program fails to start and displays one of the following errors: +The program fails to start and displays one of the following errors: + * `External component has thrown an exception` * `Value does not fall within the expected range` * `The application binding data format is invalid.` @@ -82,14 +84,14 @@ Following errors were detected during this operation. 1. Try running `CleanOnlineAppCache`, and then try installing Kusto.Explorer again. From an elevated command-prompt: - + ```kusto rundll32 %windir%\system32\dfshim.dll CleanOnlineAppCache ``` - Install Kusto.Explorer again from one of the [installation mirrors](kusto-explorer.md#installing-kustoexplorer). + Install Kusto.Explorer again from one of the [installation mirrors](kusto-explorer.md#install-kustoexplorer). -1. If the application still doesn't start, delete the local ClickOnce store. All ClickOnce apps will reinstall automatically the next time you run them, as long as you have access to the original install location stored in the app shortcut. App shortcuts won't be deleted. +1. If the application still doesn't start, delete the local ClickOnce store. All ClickOnce apps will reinstall automatically the next time you run them, as long as you have access to the original install location stored in the app shortcut. App shortcuts aren't deleted. From an elevated command-prompt: @@ -97,7 +99,7 @@ Following errors were detected during this operation. rd /q /s %userprofile%\appdata\local\apps\2.0 ``` - Install Kusto.Explorer again from one of the [installation mirrors](kusto-explorer.md#installing-kustoexplorer) + Install Kusto.Explorer again from one of the [installation mirrors](kusto-explorer.md#install-kustoexplorer) 1. If the application still doesn't start: 1. Remove temporary deployment files. @@ -110,7 +112,7 @@ Following errors were detected during this operation. ren %LOCALAPPDATA%\Kusto.Explorer Kusto.Explorer.bak ``` - 1. Install Kusto.Explorer again from one of the [installation mirrors](kusto-explorer.md#installing-kustoexplorer) + 1. Install Kusto.Explorer again from one of the [installation mirrors](kusto-explorer.md#install-kustoexplorer) 1. To restore your connections from Kusto.Explorer.bak, from an elevated command-prompt: @@ -126,20 +128,23 @@ Following errors were detected during this operation. ```kusto HKEY_CURRENT_USER\Software\Classes\Software\Microsoft\Windows\CurrentVersion\Deployment ``` - + 1. Repro it again. 1. Send the verbose output to KEBugReport@microsoft.com. ### ClickOnce error: Your administrator has blocked this application because it potentially poses a security risk to your computer #### Symptom + The application fails to install with either of the following errors: + * `Your administrator has blocked this application because it potentially poses a security risk to your computer`. * `Your security settings do not allow this application to be installed on your computer.` #### Solution -This symptom could be because another application is overriding the default ClickOnce trust prompt behavior. +This symptom could be because another application is overriding the default ClickOnce trust prompt behavior. + 1. View your default configuration settings. 1. Compare your configuration settings to the actual ones on your machine. 1. Reset your configuration settings as necessary, as explained [in this how-to article](/visualstudio/deployment/how-to-configure-the-clickonce-trust-prompt-behavior). @@ -151,7 +156,7 @@ Sometimes, when previous troubleshooting steps didn't help with getting Kusto.Ex Data stored by Kusto.Explorer application can be found here: `C:\Users\[your username]\AppData\Local\Kusto.Explorer`. > [!NOTE] -> Cleaning the data will lead to a loss of opened tabs (Recovery folder), saved connections (Connections folder), and application settings (UserSettings folder). +> Cleaning the data leads to a loss of opened tabs (Recovery folder), saved connections (Connections folder), and application settings (UserSettings folder). ## Reset Kusto.Explorer diff --git a/data-explorer/kusto/tools/kusto-explorer.md b/data-explorer/kusto/tools/kusto-explorer.md index 08c75c539b..1db5dc35a6 100644 --- a/data-explorer/kusto/tools/kusto-explorer.md +++ b/data-explorer/kusto/tools/kusto-explorer.md @@ -1,62 +1,61 @@ --- -title: Kusto.Explorer installation and user interface +title: Kusto.Explorer Installation and User Interface description: Learn about the features of Kusto.Explorer and how it can help you to explore your data ms.reviewer: alexans ms.topic: conceptual -ms.date: 08/11/2024 +ms.date: 09/15/2025 --- # Kusto.Explorer installation and user interface > [!INCLUDE [applies](../includes/applies-to-version/applies.md)] [!INCLUDE [fabric](../includes/applies-to-version/fabric.md)] [!INCLUDE [azure-data-explorer](../includes/applies-to-version/azure-data-explorer.md)] -Kusto.Explorer is free software for download and use on your Windows desktop. Kusto.Explorer allows you to query and analyze your data with Kusto Query Language (KQL) in a user-friendly interface. This overview explains how to set up Kusto.Explorer, and describes the user interface you'll use. +Kusto.Explorer is a free Windows desktop tool. Use it to query and analyze data with Kusto Query Language (KQL) in a friendly interface. This article describes how to set up Kusto.Explorer and its user interface. -With Kusto.Explorer, you can: +Use Kusto.Explorer to: -* [Query your data](kusto-explorer-using.md#query-mode). +* [Query your data](kusto-explorer-using.md#query-mode) * [Search your data](kusto-explorer-using.md#search-mode) across tables. -* [Visualize your data](#visualizations-section) in a wide variety of graphs. -* [Share queries and results](kusto-explorer-using.md#share-queries-and-results) by email or using deep links. +* [Visualize your data](#visualizations-section) in charts. +* [Share queries and results](kusto-explorer-using.md#share-queries-and-results) by email or deep link. -## Installing Kusto.Explorer +## Install Kusto.Explorer -* Download and install the Kusto.Explorer tool from: +* Download and install Kusto.Explorer from: * [https://aka.ms/ke](https://aka.ms/ke) -* Alternatively, access your Kusto cluster with a ClickOnce-enabled browser at: +* Or use a ClickOnce-enabled browser to access your Kusto cluster at: `https:///?web=0` - Replace <your_cluster> with your cluster URI (for example, `help.kusto.windows.net`.) +Replace the `` placeholder with your cluster URI (for example, `help.kusto.windows.net`). -### Using Google Chrome and Kusto.Explorer +### Use Google Chrome with Kusto.Explorer -If Google Chrome is your default browser, installing the ClickOnce extension for Chrome is required. -[https://chromewebstore.google.com/detail/clickonce-for-google-chro/kekahkplibinaibelipdcikofmedafmb?hl=en-US](https://chromewebstore.google.com/detail/clickonce-for-google-chro/kekahkplibinaibelipdcikofmedafmb?hl=en-US) +If Google Chrome is your default browser, install the ClickOnce extension. +[ClickOnce extension for Chrome](https://chromewebstore.google.com/detail/clickonce-for-google-chro/kekahkplibinaibelipdcikofmedafmb?hl=en-US) -If your default browser is the Microsoft Edge, installing this extension *isn't* required. -Validate your ClickOnce settings in [Microsoft Edge flag settings](edge://flags/#edge-click-once). +If Microsoft Edge is your default browser, you don't need this extension. +Check ClickOnce settings in [Microsoft Edge flags](edge://flags/#edge-click-once). ## Overview of the user interface -The Kusto.Explorer user interface is designed with a layout based on tabs and panels, similar to that of other Microsoft products: +Kusto.Explorer uses tabs and panels: -* Navigate through the tabs on the [menu panel](#menu-panel) to perform various operations -* Manage your connections in the [connections panel](#connections-panel) -* Create scripts to run in the script panel -* View the results of the scripts in the results panel +* Use the [menu panel](#menu-panel) to perform tasks. +* Manage connections in the [connections panel](#connections-panel). +* Create and run scripts in the script panel. +* View script results in the results panel. -:::image type="content" source="media/kusto-explorer/ke-start.png" alt-text="Screenshot of Kusto Explorer user interface that shows an overview of the interface's four panels."::: +:::image type="content" source="media/kusto-explorer/ke-start.png" alt-text="Screenshot of Kusto.Explorer showing four main panels: menu, connections, script, and results." lightbox="media/kusto-explorer/ke-start.png"::: ## Connections panel -:::image type="content" source="media/kusto-explorer/connections-panel.png" alt-text="Screenshot of the Connections panel that shows the Help cluster's databases."::: +:::image type="content" source="media/kusto-explorer/connections-panel.png" alt-text="Screenshot of the Connections panel that shows the Help cluster's databases." lightbox="media/kusto-explorer/connections-panel.png"::: -The Connections pane shows all the configured cluster connections. For each cluster the databases, tables, and attributes (columns) that they store are shown. Select items (which sets an implicit context -for the search/query in the main panel), or double-click items to copy the name to the search/query panel. +The **Connections** panel lists all configured cluster connections. For each cluster, it lists databases, tables, and columns. Select an item to set context for the search or query in the main panel. To copy a name to the search or query panel, double-click the item. -If the actual schema is large (such as a database with hundreds of tables), you can search it by pressing **CTRL+F** and entering a substring (case-insensitive) of the entity name you're looking for. +If the schema is large (for example, a database with hundreds of tables), select Ctrl+F and enter a case-insensitive part of the entity name to search. -Kusto.Explorer supports controlling the Connection panel from the query window, which is useful for scripts. For example, you can start a script file with a command that instructs Kusto.Explorer to connect to the cluster/database the script queries, using the following syntax: +Control the **Connections** panel from the query window to support scripted workflows. Start the script with a command that tells Kusto.Explorer to connect to the cluster and database that the script queries: ```kusto @@ -65,33 +64,33 @@ Kusto.Explorer supports controlling the Connection panel from the query window, StormEvents | count ``` -Run each line using `F5`, or similar. +Run each line with F5. -## Work Documents panel +## Work Documents pane -:::image type="content" source="media/kusto-explorer/work-folders-pane.png" alt-text="Screenshot of the Work Folders panel showing Unsaved work and Tracked Folders."::: +:::image type="content" source="media/kusto-explorer/work-folders-pane.png" alt-text="Screenshot of the Work documents pane showing Unsaved work and Tracked folders." lightbox="media/kusto-explorer/work-folders-pane.png"::: -The Work folders pane organizes your work folders in one place to make navigating your work easier. There are two types of work folders: +The Work folders pane organizes your work folders for quick navigation. It includes two types: -* **Unsaved work**: lists folders for open query tabs that you may still be working on. -* **Tracked folders**: lists folders from your local device that you can add as KQL libraries for easier access and management. +* **Unsaved work**: Folders for open query tabs you're still editing +* **Tracked folders**: Device folders you add as KQL libraries for easier access and management ## Menu panel ### Home tab -:::image type="content" source="media/kusto-explorer/home-tab.png" alt-text="Screenshot of the Home tab that shows the Home tab's five sections."::: +:::image type="content" source="media/kusto-explorer/home-tab.png" alt-text="Screenshot of the Home tab that shows the Home tab's five sections." lightbox="media/kusto-explorer/home-tab.png"::: The Home tab shows the most frequently used operations. It includes: ### Query section -:::image type="content" source="media/kusto-explorer/home-query-menu.png" alt-text="Screenshot of the Home tab section titled Tabs that shows an option for creating a new tab for queries."::: +:::image type="content" source="media/kusto-explorer/home-query-menu.png" alt-text="Screenshot of the Home tab section titled Tabs that shows an option for creating a new tab for queries." lightbox="media/kusto-explorer/home-query-menu.png"::: |Menu| Behavior| |----|----------| -|Mode dropdown | | -|New Tab| Opens a new tab for querying Kusto Query Language. | +|Mode dropdown | | +|New Tab| Opens a new query tab for Kusto Query Language (KQL). | ### Share section @@ -99,30 +98,30 @@ The Home tab shows the most frequently used operations. It includes: |Menu| Behavior| |----|----------| -|Data To Clipboard| Exports Query and dataset to a clipboard. If a chart is presented, it exports the chart as bitmap| -|Result To Clipboard| Exports the dataset to a clipboard. If a chart is presented, it exports the chart as bitmap| -|Query to Clipboard| Exports the Query to a clipboard| +|Data To Clipboard| Copies the query and dataset to the clipboard. If a chart is shown, also copies the chart as a bitmap.| +|Result To Clipboard| Copies the dataset to the clipboard. If a chart is shown, also copies the chart as a bitmap.| +|Query to Clipboard| Copies the query to the clipboard.| ### Visualizations section :::image type="content" source="media/kusto-explorer/home-visualizations-menu.png" alt-text="Screenshot of the Home tab section titled Visualizations that shows the different options for visualizing data."::: -For variable visualizations, see the [render operator](../query/render-operator.md). +For more visualization options, see the [render operator](../query/render-operator.md). |Menu | Behavior| |-------------|---------| -|Area chart | Displays an area chart in which the X-axis is the first column (must be numeric). All numeric columns are mapped to different series (Y-axis). | -|Column Chart | Displays a column chart where all numeric columns are mapped to different series (Y-axis). The text column before numeric is the X-axis (can be controlled in the UI).| -|Bar Chart | Displays a bar chart where all numeric columns are mapped to different series (X-axis). The text column before numeric is the Y-axis (can be controlled in the UI).| -|Stacked Area Chart | Displays a stacked area chart in which the X-axis is the first column (must be numeric). All numeric columns are mapped to different series (Y-axis). | -|Time Chart | Displays a time chart in which the X-axis is the first column (must be datetime). All numeric columns are mapped to different series (Y-axis).| -|Line Chart | Displays a line chart in which the X-axis is the first column (must be numeric). All numeric columns are mapped to different series (Y-axis).| -|Anomaly Chart| Similar to Time Chart, but finds anomalies in time series data, using a machine learning anomaly detection algorithm. The data must be in fixed interval buckets. For anomaly detection, Kusto.Explorer uses the [series_decompose_anomalies](../query/series-decompose-anomalies-function.md) function. -|Pie Chart | Displays a pie chart in which the color-axis is the first column. The theta-axis (must be a measure, converted to percent) is the second column.| -|Time Ladder | Displays a ladder chart in which the X-axis is the last two columns (must be datetime). The Y-axis is a composite of the other columns.| -|Scatter Chart| Displays a point graph in which the X-axis is the first column (must be numeric). All numeric columns are mapped to different series (Y-axis).| -|Pivot Chart | Displays a pivot table and pivot chart that gives the full flexibility of selecting data, columns, rows, and various chart types.| -|Time Pivot | Interactive navigation over the events time-line (pivoting on time axis)| +|Area chart | Shows an area chart where the first column (numeric) is the X-axis. Maps each numeric column to a separate Y-axis series. | +|Column Chart | Shows a column chart where all numeric columns are mapped to different series (Y-axis). The text column before numeric is the X-axis (can be controlled in the UI).| +|Bar Chart | Shows a bar chart where all numeric columns are mapped to different series (X-axis). The text column before numeric is the Y-axis (can be controlled in the UI).| +|Stacked Area Chart | Shows a stacked area chart in which the X-axis is the first column (must be numeric). All numeric columns are mapped to different series (Y-axis). | +|Time Chart | Shows a time chart in which the X-axis is the first column (must be datetime). All numeric columns are mapped to different series (Y-axis).| +|Line Chart | Shows a line chart in which the X-axis is the first column (must be numeric). All numeric columns are mapped to different series (Y-axis).| +|Anomaly Chart| Similar to Time Chart but detects anomalies in time series data by using a machine learning algorithm. Data must use fixed interval buckets. For anomaly detection, Kusto.Explorer uses the [series_decompose_anomalies](../query/series-decompose-anomalies-function.md) function.| +|Pie Chart | Shows a pie chart in which the color axis is the first column. The theta axis (must be a measure, converted to percent) is the second column.| +|Time Ladder | Shows a ladder chart in which the X-axis is the last two columns (must be datetime). The Y-axis is a composite of the other columns.| +|Scatter Chart| Shows a point graph in which the X-axis is the first column (must be numeric). All numeric columns are mapped to different series (Y-axis).| +|Pivot Chart | Shows a pivot table and chart that lets you select data, columns, rows, and chart types.| +|Time Pivot | Lets you navigate the event timeline interactively (pivots on the time axis).| ### View section @@ -130,17 +129,17 @@ For variable visualizations, see the [render operator](../query/render-operator. |Menu | Behavior| |---------------|---------| -|Full View Mode | Maximizes the work space by hiding the ribbon menu and Connection Panel. Exit Full View Mode by selecting **Home** > **Full View Mode**, or by pressing **F11**.| +|Full View Mode | Maximizes the workspace by hiding the ribbon menu and Connection Panel. Exit Full View Mode by selecting **Home** > **Full View Mode**, or by pressing F11.| |Hide Empty Columns| Removes empty columns from the data grid.| |Collapse Singular Columns| Collapses columns with singular values.| -|Explore Column Values| Shows column values distribution| -|Increase Font | Increases the font size of the query tab and of the results data grid.| -|Decrease Font | Decreases the font size of the query tab and of the results data grid.| +|Explore Column Values| Shows the distribution of column values.| +|**Increase Font**| Increases font size in the query tab and results grid.| +|**Decrease Font**| Decreases font size in the query tab and results grid.| >[!NOTE] -> Data View Settings: +> Data view settings: > -> Kusto.Explorer keeps track of what settings are used per unique set of columns. When columns are reordered or removed, the data view is saved and will be reused whenever the data with the same columns is retrieved. To reset the view to its defaults, in the **View** tab, select **Reset View**. +> Kusto.Explorer tracks settings for each unique set of columns. When you reorder or remove columns, it saves the data view and reuses it when you retrieve data with the same columns. To reset the view to its defaults, on the **View** tab, select **Reset View**. ## File tab @@ -148,31 +147,31 @@ For variable visualizations, see the [render operator](../query/render-operator. |Menu| Behavior| |---------------|---------| -||---------*Query Script*---------| +| **Query script** | | |New Tab | Opens a new tab window for querying Kusto. | -|Open File| Loads data from a *.kql file to the active script panel.| -|Save To File| Saves the content of the active script panel to *.kql file.| -|Close Tab| Closes the current tab window| -||---------*Profiles*---------| -|Import Profile| Import a Kusto.Explorer profile. | -|Export Profile| Export a Kusto.Explorer profile.| -||---------*Save Data*---------| +|Open File| Loads a .kql script into the active query pane.| +|Save To File| Saves the active script to a .kql file.| +|Close Tab| Closes the current tab.| +| **Profiles** | | +|Import Profile| Imports a Kusto.Explorer profile.| +|Export Profile| Exports a Kusto.Explorer profile.| +| **Save data** | | |Data To CSV | Exports data to a CSV (comma-separated-values) file.| |Data To JSON | Exports data to a JSON formatted file.| |Data To Excel | Exports data to an XLSX (Excel) file.| |Data To Text | Exports data to a TXT (text) file.| -|Data To KQL Script| Exports Query to a script file.| -|Data To Results | Exports Query and data to a Results (QRES) file.| -|Run Query Into CSV |Runs a query and saves the results to a local CSV file.| -||---------*Load Data*---------| -|From Results| Loads Query and data from a Results (QRES) file.| -||---------*Clipboard*---------| -|Query and Results To Clipboard| Exports Query and dataset to a clipboard. If a chart is presented, it exports the chart as a bitmap.| -|Result To Clipboard| Exports dataset to a clipboard. If a chart is presented, it exports the chart as a bitmap.| -|Query To Clipboard| Exports the Query to a clipboard.| -|Results To Clipboard (datatable())| Exports query results to a clipboard. Maximal allowed cell value is 30000.| -||---------*Results*---------| -|Clear results cache| Clears cached results of previously executed queries.| +|Data To KQL Script| Exports the query to a script file.| +|Data To Results | Exports the query and data to a results (QRES) file.| +|Run Query Into CSV | Runs the query and saves the results to a local CSV file.| +| **Load data** | | +|From Results| Loads the query and data from a results (QRES) file.| +| **Clipboard** | | +|Query and Results To Clipboard| Copies the query and dataset to the clipboard. If a chart is shown, copies the chart as a bitmap.| +|Result To Clipboard| Copies the dataset to the clipboard. If a chart is shown, copies the chart as a bitmap.| +|Query To Clipboard| Copies the query to the clipboard.| +|Results To Clipboard (datatable())| Copies the query results to the clipboard. The maximum allowed cell value is 30,000.| +| **Results** | | +|Clear results cache| Clears cached results of previously run queries.| ## Connections tab @@ -180,114 +179,116 @@ For variable visualizations, see the [render operator](../query/render-operator. |Menu|Behavior| |----|----------| -||---------*Groups*---------| -|Add Group| Adds a new Kusto Server group.| -||---------*Clusters*---------| -|Import Connections| Imports connections from a file specifying connections.| -|Export Connections| Exports connections to a file.| -|Add Connection| Adds a new Kusto Server connection.| -|Edit Connection| Opens a dialog for Kusto Server connection properties editing.| -|Remove Connection| Removes the existing connection to Kusto Server.| -|Refresh| Refreshes properties of a Kusto server connection.| -||---------*Profiles*---------| +| **Groups**| | +|Add Group| Add a Kusto server group.| +| **Clusters**| | +|Import Connections| Import connections from a file.| +|Export Connections| Export connections to a file.| +|Add Connection| Add a Kusto server connection.| +|Edit Connection| Open the connection properties dialog.| +|Remove Connection| Remove the Kusto server connection.| +|Refresh| Refresh the connection properties.| +| **Profiles** | | |Import Profile| Import a Kusto.Explorer profile.| |Export Profile| Export a Kusto.Explorer profile.| -||---------*Security*---------| -|Inspect Your ADD Principal| Shows currents active user details.| -|Sign-out| Signs-out the current user from the connection to Microsoft Entra ID.| -||---------*Data Scope*---------| -|Caching scope| | -|DateTime Column| Name of a column that may be used for time pre-filter.| -|Time Filter| Value of time pre-filter.| +|**Security**| | +|Inspect Your ADD Principal| Show current signed-in user details.| +|Sign-out| Sign out the current user from Microsoft Entra ID.| +|**Data scope**| | +|Caching scope| | +|DateTime Column| Name of a column you can use for a time prefilter.| +|Time Filter| Value of the time prefilter.| ## View tab -:::image type="content" source="media/kusto-explorer/view-tab.png" alt-text="Screenshot of the View tab that shows the View tab's four sections."::: +:::image type="content" source="media/kusto-explorer/view-tab.png" alt-text="Screenshot of the View tab showing four sections: Appearance, Data View, Data Filtering, and Visualizations."::: |Menu|Behavior| |----|----------| -||---------*Appearance*---------| -|Full View Mode | Maximizes the work space by hiding the ribbon menu and Connection Panel. Exit Full View Mode by selecting **Home** > **Full View Mode**, or by pressing **F11**.| +| **Appearance** | | +|Full View Mode | Maximizes the work space by hiding the ribbon menu and Connection Panel. Exit Full View Mode by selecting **Home** > **Full View Mode**, or by pressing **F11 .| |Increase Font | Increases the font size of the query tab and of the results data grid.| |Decrease Font | Decreases the font size of the query tab and of the results data grid.| -|Reset Layout|Resets the layout of the tool's docking controls and windows.| -|Rename Document Tab |Rename the selected tab. | -||---------*Data View*---------| -|Reset View| Resets [data view settings](#dvs) to its defaults. | -|Explore Column Values|Shows column values distribution.| -|Focus on Query Statistics|Changes the focus to query statistics instead of query results upon query completion.| -|Hide Duplicates|Toggles removal of the duplicate rows from the query results.| -|Hide Empty Columns|Removes empty columns from the query results.| -|Collapse Singular Columns|Collapses columns with singular values.| -|Row Selection| Enables selection of specific rows in the Results panel| -|Color By Column| Groups identical records in the first column by color.| -|Wrap Text| Formats cells to wrap the data to fit the column width.| -||---------*Data Filtering*---------| -|Filter Rows In Search|Toggles the option to show only matching rows in query results search (**Ctrl+F**).| -||---------*Visualizations*---------| -|Visualizations|See [Visualizations](#visualizations-section). | +| Reset Layout |Resets the docking layout and windows.| +| Rename Document Tab |Renames the selected tab.| +| **Data View** | | +| Reset View | Resets the [data view settings](#dvs) to their defaults.| +| Explore Column Values |Shows the distribution of column values.| +| Focus on Query Statistics |Shows query statistics instead of results when the query finishes.| +| Hide Duplicates |Toggles removal of duplicate rows from results.| +| Hide Empty Columns |Removes empty columns from the results.| +| Collapse Singular Columns |Collapses columns that contain a single value.| +| Row Selection |Enables selecting specific rows in the Results panel.| +| Color By Column |Colors identical values in the first column.| +| Wrap Text |Wraps cell content to fit the column width.| +| **Data Filtering** | | +| Filter Rows In Search |Toggles showing only matching rows when you search ( **Ctrl+F** ).| +| **Visualizations** | | +| Visualizations |See [Visualizations](#visualizations-section).| > [!NOTE] > Data View Settings: > -> Kusto.Explorer keeps track of the settings used per unique set of columns. When columns are reordered or removed, the data view is saved and will be reused whenever the data with the same columns is retrieved. To reset the view to its defaults, in the **View** tab, select **Reset View**. +> Kusto.Explorer tracks settings per unique set of columns. When you reorder or remove columns, it saves the data view and reuses it when it retrieves data with the same columns. To reset to defaults, in the **View** tab, select **Reset View**. ## Tools tab -:::image type="content" source="media/kusto-explorer/tools-tab.png" alt-text="Screenshot of the Tool tab that shows the Tool tab's six sections."::: +:::image type="content" source="media/kusto-explorer/tools-tab.png" alt-text="Screenshot of the Tools tab that shows its six sections."::: |Menu|Behavior| |----|----------| -||---------*IntelliSense*---------| -|Enable IntelliSense| Enables and disables IntelliSense on the Script Panel.| +| IntelliSense || +|Enable IntelliSense| Enables or disables IntelliSense in the Script panel.| |Issues List| Lists issues in the Script panel.| -||---------*Automation*---------| -|Add New Automation| Produces an analysis report that provides insights about the query.| -||---------*Utilities*---------| -|Command-line tools|Opens the command prompt on your computer.| -|Compress LZ4 file|Compresses files using the LZ4 algorithm.| -|Decompress LZ4 file| Decompresses files using the LZ4 algorithm.| -||---------*Analytics*---------| -|Analytical Reports| Opens a dashboard with multiple pre-built reports for data analysis.| -||---------*Translate*---------| -|Query to Power BI| Translates a query to a format suitable for using in Power BI.| -||---------*Options*---------| -|Reset Options| Sets application settings to default values.| -|Options| Opens a tool for configuring application settings. To learn more, see [Kusto.Explorer options](kusto-explorer-options.md).| +| Automation || +|Add New Automation| Generates a report with query insights.| +| Utilities || +|Command-line tools| Opens a command prompt.| +|Compress LZ4 file| Compresses files with the LZ4 algorithm.| +|Decompress LZ4 file| Decompresses files with the LZ4 algorithm.| +| Analytics || +|Analytical Reports| Opens a dashboard with prebuilt data analysis reports.| +| Translate || +|Query to Power BI| Converts a query to a Power BI format.| +|Query to WPA| Converts a query to a WPA format.| +|Query to WPA (Clipboard) | Converts a query to a WPA format and copies it to the clipboard.| +| Options || +|Reset Options| Resets app settings to default values.| +|Options| Opens the options tool to configure app settings. For details, see [Kusto.Explorer options](kusto-explorer-options.md).| ## Table row colors -Kusto.Explorer tries to interpret the severity or verbosity level of each row in the results panel and color them accordingly. It does this by matching the distinct values of each column with a set of known patterns ("Warning," "Error," and so on). +Kusto.Explorer interprets each row's severity or verbosity level in the results panel and colors rows accordingly. It matches distinct column values to known patterns (for example, "Warning", "Error"). -To modify the output color scheme, or turn off this behavior, from the **Tools** menu, select **Options** > **Results Viewer** > **Verbosity color scheme**. +To change the output color scheme or turn off this behavior, select **Tools** > **Options** > **Results Viewer** > **Verbosity color scheme**. :::image type="content" source="media/kusto-explorer/ke-color-scheme.png" alt-text="Screenshot of Kusto Explorer color scheme modification."::: -**Excel** color scheme legend| **Vivid** color scheme legend -|---|--- -| :::image type="content" source="media/kusto-explorer/excel-color-scheme.png" alt-text="Screenshot of the Excel color scheme legend in Kusto Explorer." border="false"::: |:::image type="content" source="media/kusto-explorer/vivid-color-scheme.png" alt-text="Screenshot vivid color scheme legend in Kusto Explorer." border="false"::: +**Excel** color scheme legend | **Vivid** color scheme legend +|---|---| +|:::image type="content" source="media/kusto-explorer/excel-color-scheme.png" alt-text="Screenshot of the Excel color scheme legend in Kusto Explorer." border="false"::: | :::image type="content" source="media/kusto-explorer/vivid-color-scheme.png" alt-text="Screenshot of vivid color scheme legend in Kusto Explorer." border="false":::| ## Monitoring tab -:::image type="content" source="media/kusto-explorer/monitoring-tab.png" alt-text="Screenshot of the Monitoring tab that shows two options for monitoring data."::: +:::image type="content" source="media/kusto-explorer/monitoring-tab.png" alt-text="Screenshot of the Monitoring tab with two options for monitoring data."::: |Menu | Behavior| |-----------------|---------| -||---------*Monitor*---------| -|Cluster Diagnostics | Shows a health summary for the Server Group currently selected in Connections Panel. | -|Latest data: All tables| Shows a summary of the latest data in all tables of the currently selected database.| -|Latest data: Selected table|Shows in the status bar the latest data in the selected table.| +| **Monitor** | | +| Cluster Diagnostics | Shows a health summary for the Server Group currently selected in Connections Panel. | +| Latest data: All tables | Shows a summary of the latest data in all tables of the currently selected database.| +| Latest data: Selected table | Shows the latest data for the selected table in the status bar.| ## Management tab -:::image type="content" source="media/kusto-explorer/management-tab.png" alt-text="Screenshot of the Management tab that shows options for managing Authorized Principals. "::: +:::image type="content" source="media/kusto-explorer/management-tab.png" alt-text="Screenshot of the Management tab that shows options for managing authorized principals."::: -|Menu | Behavior| +| Menu | Behavior| |-----------------|---------| -||---------*Authorized Principals*---------| -|Manage Database Authorized Principals | Enables managing a database's principals for authorized users.| -|Manage Table Authorized Principals | Enables managing a table's principals for authorized users.| -|Manage Function Authorized Principals | Enables managing a function's principals for authorized users.| +| **Authorized Principals** | | +| Manage Database Authorized Principals | Lets authorized users manage database principals.| +| Manage Table Authorized Principals | Lets authorized users manage table principals.| +| Manage Function Authorized Principals | Lets authorized users manage function principals.| ## Help tab @@ -295,35 +296,33 @@ To modify the output color scheme, or turn off this behavior, from the **Tools** |Menu | Behavior| |-----------------|---------| -||---------*Documentation*---------| -|Help | Opens a link to the Kusto online documentation. | -|What's new | Opens a document that lists all Kusto.Explorer changes.| -|Report Issue |Opens a dialog with two options: . | -|Keyboard Shortcuts| Opens a link to the [list of Kusto.Explorer keyboard shortcuts](kusto-explorer-shortcuts.md).| -|Show EULA| Opens a link to the Microsoft Azure Legal Information article.| +| **Documentation** | | +| Help | Opens the Kusto online documentation.| +| What's new | Opens the Kusto.Explorer release notes.| +| Keyboard Shortcuts | Opens the [Kusto.Explorer keyboard shortcuts](kusto-explorer-shortcuts.md).| +| Show EULA | Opens the Microsoft Azure Legal Information article.| +| Support and Feedback| | +| Issue Report | Opens a dialog with two options: .| +| Suggest Feature | Opens a page to share your ideas.| +| Kusto Support (KAI Bot) | Opens KAI for self-service, proactive guidance, and autonomous troubleshooting. | ### Control the user identity connecting to Kusto.Explorer -The default security model for new connections is Microsoft Entra ID-Federated security. Authentication is done through the Microsoft Entra ID using the default Microsoft Entra user experience. +The default security model for new connections is Microsoft Entra ID federated security. Authentication uses Microsoft Entra ID with the default Microsoft Entra sign-in experience. -If you need finer control over the authentication parameters, you can expand the -"Advanced: Connection Strings" edit box and provide a valid -[Kusto connection string](../api/connection-strings/kusto.md) value. +For finer control over authentication parameters, expand the **Advanced: Connection Strings** box and enter a valid [Kusto connection string](../api/connection-strings/kusto.md). -For example, users with a presence in -multiple Microsoft Entra tenants sometimes need to use a particular "projection" -of their identities to a specific Microsoft Entra tenant, which can be done through -the connection string (replace words IN CAPITALS with specific values): +For example, users in multiple Microsoft Entra tenants sometimes need to select a specific identity in a target tenant. Use the connection string to specify it. Replace the placeholder values in angle brackets with your own values: ```kusto -Data Source=https://CLUSTER_NAME.kusto.windows.net;Initial Catalog=DATABASE_NAME;AAD Federated Security=True;Authority Id=AAD_TENANT_OF_CLUSTER;User=USER_DOMAIN +Data Source=https://.kusto.windows.net;Initial Catalog=;AAD Federated Security=True;Authority Id=;User= ``` -* `AAD_TENANT_OF_CLUSTER` is a domain name or Microsoft Entra tenant ID (a GUID) of the tenant in which the cluster is hosted. For example, `contoso.com`. -* USER_DOMAIN is the identity of the user invited into that tenant (for example, `user@example.com`). +* `` is the domain name or Microsoft Entra tenant ID (a GUID) of the tenant that hosts the cluster (for example, contoso.com). +* `` is the user identity invited into that tenant (for example, user@example.com). >[!NOTE] -> The domain name of the user is not necessarily the same as that of the tenant hosting the cluster. +> The user's domain name might differ from the tenant that hosts the cluster. :::image type="content" source="media/kusto-explorer/advanced-connection-string.png" alt-text="Screenshot of the Add Connection pane showing the option titled Advanced Connection String."::: diff --git a/data-explorer/kusto/tools/media/kusto-explorer/advanced-connection-string.png b/data-explorer/kusto/tools/media/kusto-explorer/advanced-connection-string.png index de8f492ad9..c3c23e386f 100644 Binary files a/data-explorer/kusto/tools/media/kusto-explorer/advanced-connection-string.png and b/data-explorer/kusto/tools/media/kusto-explorer/advanced-connection-string.png differ diff --git a/data-explorer/kusto/tools/media/kusto-explorer/connections-panel.png b/data-explorer/kusto/tools/media/kusto-explorer/connections-panel.png index ef8adba1dd..8f05dde9f4 100644 Binary files a/data-explorer/kusto/tools/media/kusto-explorer/connections-panel.png and b/data-explorer/kusto/tools/media/kusto-explorer/connections-panel.png differ diff --git a/data-explorer/kusto/tools/media/kusto-explorer/connections-tab.png b/data-explorer/kusto/tools/media/kusto-explorer/connections-tab.png index 5a17c9acd7..8a504784a7 100644 Binary files a/data-explorer/kusto/tools/media/kusto-explorer/connections-tab.png and b/data-explorer/kusto/tools/media/kusto-explorer/connections-tab.png differ diff --git a/data-explorer/kusto/tools/media/kusto-explorer/file-tab.png b/data-explorer/kusto/tools/media/kusto-explorer/file-tab.png index 9ff4243e02..f5845bb951 100644 Binary files a/data-explorer/kusto/tools/media/kusto-explorer/file-tab.png and b/data-explorer/kusto/tools/media/kusto-explorer/file-tab.png differ diff --git a/data-explorer/kusto/tools/media/kusto-explorer/help-tab.png b/data-explorer/kusto/tools/media/kusto-explorer/help-tab.png index 31c6e34c2f..d1ef6fc572 100644 Binary files a/data-explorer/kusto/tools/media/kusto-explorer/help-tab.png and b/data-explorer/kusto/tools/media/kusto-explorer/help-tab.png differ diff --git a/data-explorer/kusto/tools/media/kusto-explorer/home-tab.png b/data-explorer/kusto/tools/media/kusto-explorer/home-tab.png index 78f9978e3c..d5e74b2685 100644 Binary files a/data-explorer/kusto/tools/media/kusto-explorer/home-tab.png and b/data-explorer/kusto/tools/media/kusto-explorer/home-tab.png differ diff --git a/data-explorer/kusto/tools/media/kusto-explorer/home-visualizations-menu.png b/data-explorer/kusto/tools/media/kusto-explorer/home-visualizations-menu.png index 08ffe326eb..5d933248c1 100644 Binary files a/data-explorer/kusto/tools/media/kusto-explorer/home-visualizations-menu.png and b/data-explorer/kusto/tools/media/kusto-explorer/home-visualizations-menu.png differ diff --git a/data-explorer/kusto/tools/media/kusto-explorer/ke-color-scheme.png b/data-explorer/kusto/tools/media/kusto-explorer/ke-color-scheme.png index c480f63237..a4be8ae090 100644 Binary files a/data-explorer/kusto/tools/media/kusto-explorer/ke-color-scheme.png and b/data-explorer/kusto/tools/media/kusto-explorer/ke-color-scheme.png differ diff --git a/data-explorer/kusto/tools/media/kusto-explorer/ke-start.png b/data-explorer/kusto/tools/media/kusto-explorer/ke-start.png index f5055bfd95..3e2d3a9215 100644 Binary files a/data-explorer/kusto/tools/media/kusto-explorer/ke-start.png and b/data-explorer/kusto/tools/media/kusto-explorer/ke-start.png differ diff --git a/data-explorer/kusto/tools/media/kusto-explorer/tools-tab.png b/data-explorer/kusto/tools/media/kusto-explorer/tools-tab.png index 82b82b81e5..61194bec57 100644 Binary files a/data-explorer/kusto/tools/media/kusto-explorer/tools-tab.png and b/data-explorer/kusto/tools/media/kusto-explorer/tools-tab.png differ diff --git a/data-explorer/kusto/tools/media/kusto-explorer/view-tab.png b/data-explorer/kusto/tools/media/kusto-explorer/view-tab.png index 3fc8f39f1a..9fc893f264 100644 Binary files a/data-explorer/kusto/tools/media/kusto-explorer/view-tab.png and b/data-explorer/kusto/tools/media/kusto-explorer/view-tab.png differ diff --git a/data-explorer/kusto/tools/media/kusto-explorer/work-folders-pane.png b/data-explorer/kusto/tools/media/kusto-explorer/work-folders-pane.png index e7af4135ae..43b52ca5d1 100644 Binary files a/data-explorer/kusto/tools/media/kusto-explorer/work-folders-pane.png and b/data-explorer/kusto/tools/media/kusto-explorer/work-folders-pane.png differ