快速入門:在 Azure 資料總管中查詢資料Quickstart: Query data in Azure Data Explorer

Azure 資料總管是一項快速又可高度調整的資料探索服務,可用於處理記錄和遙測資料。Azure Data Explorer is a fast and highly scalable data exploration service for log and telemetry data. Azure 資料總管提供一個讓您執行和共用查詢的 Web 應用程式。Azure Data explorer provides a web application that enables you to run and share queries. 它可在 Azure 入口網站中取得,也以獨立的 Web 應用程式的形式提供。The application is available in the Azure portal and as a stand-alone web application. 在本文中,您將在獨立的版本中進行作業,它能讓您連接到多個叢集以及共用深層連結到查詢。In this article, you work in the stand-alone version, which enables you to connect to multiple clusters and to share deep links to your queries.

如果您沒有 Azure 訂用帳戶,請在開始前建立免費 Azure 帳戶If you don't have an Azure subscription, create a free Azure account before you begin.

必要條件Prerequisites

除了 Azure 訂用帳戶之外,您還需要一個測試叢集和資料庫,才能完成此快速入門。In addition to an Azure subscription, you need a test cluster and database to complete this quickstart.

登入應用程式Sign in to the application

登入應用程式Sign in to the application.

新增叢集Add clusters

當您第一次開啟應用程式時,沒有任何連線。When you first open the application, there are no connections.

新增叢集

您必須將連線新增到至少一個叢集,才能開始執行查詢。You must add a connection to at least one cluster before you can start running queries. 在此節中,您將連線新增至 Azure 資料總管中我們已設置要輔助學習的說明叢集,也要將連線新增到在先前快速入門中建立的測試叢集。In this section, you add connections to the Azure Data Explorer help cluster that we have set up to aid learning, and to the test cluster you created in a previous quickstart.

  1. 在應用程式的左上方中,選取 [新增叢集]。In the upper-left of the application, select Add cluster.

  2. 在 [新增叢集] 對話方塊中,輸入 URI,然後選取 [新增]。In the Add cluster dialog box, enter the URI, then select Add.

    您可以使用說明叢集 URI,https://help.kusto.windows.netYou may use the help cluster URI, https://help.kusto.windows.net. 如果您有自己的叢集,請提供您叢集的 URI。If you have your own cluster, provide the URI of your cluster. 例如,如下圖所示的 https://mydataexplorercluster.westus.kusto.windows.netFor example, https://mydataexplorercluster.westus.kusto.windows.net as in the following image:

    入口網站中的伺服器 URI

  3. 在左窗格中,您現在應該會看到 [說明] 叢集。In the left pane, you should now see the help cluster. 展開 [範例] 資料庫,以便看到您可以存取的範例資料表。Expand the Samples database so that you can see the sample tables that you have access to.

    範例資料庫

    我們在此快速入門與 Azure 資料總管文章中稍後會使用 StormEvents 資料表。We use the StormEvents table later in this quickstart, and in other Azure Data Explorer articles.

現在加入之前建立的測試叢集。Now add the test cluster you created.

  1. 選取 [新增叢集]。Select Add cluster.

  2. 在 [新增叢集] 對話方塊中,以 https://<ClusterName>.<Region>.kusto.windows.net/ 格式輸入您的測試叢集 URL,然後選取 [新增]。In the Add cluster dialog box, enter your test cluster URL in the form https://<ClusterName>.<Region>.kusto.windows.net/, then select Add.

    在下面的範例中,您會看到 [說明] 叢集和一個新的叢集 docscluster.westus (完整的 URL 是 https://docscluster.westus.kusto.windows.net/)。In the example below, you see the help cluster and a new cluster, docscluster.westus (full URL is https://docscluster.westus.kusto.windows.net/).

    測試叢集

執行查詢Run queries

您現在可以對連線的叢集執行查詢 (假設測試叢集中已經有資料)。You can now run queries against either cluster that you're connected to (assuming you have data in your test cluster). 我們將著重 [i說明] 叢集。We'll focus on the help cluster.

  1. 在左窗格中,在 [說明]叢集下面選取 [範例] 資料庫。In the left pane, under the help cluster, select the Samples database.

  2. 複製下列查詢並貼到查詢視窗中。Copy and paste the following query into the query window. 在視窗頂端,選取 [執行] 。At the top of the window, select Run.

    StormEvents
    | sort by StartTime desc
    | take 10
    

    此查詢會傳回 StormEvents 資料表中最新的十筆記錄。This query returns the ten newest records in the StormEvents table. 結果的左邊結果應該會類似於下面的表格。The left side of the result should look like the following table.

    查詢結果集

    下圖顯示應用程式現在的狀態,包含已新增的叢集以及包含結果的查詢。The following image shows the state that the application should now be in, with clusters added, and a query with results.

    完整應用程式

  3. 在第一個查詢下面,複製下列查詢並貼到查詢視窗中。Copy and paste the following query into the query window, below the first query. 請注意,它有好幾行且尚未格式化,不像第一個查詢。Notice how it's not formatted on separate lines like the first query.

    StormEvents | sort by StartTime desc | project StartTime, EndTime, State, EventType, DamageProperty, EpisodeNarrative | take 10
    
  4. 按一下視窗中的新查詢以選取該查詢。Click the new query in the window, which selects the query. 按 Shift + Alt + F 來格式化查詢,讓它看起來如下所示。Press Shift+Alt+F to format the query, so it looks like the following.

    經過格式化的查詢

  5. 按 Shift + Enter,也就是執行查詢的快速鍵。Press Shift+Enter, which is a shortcut to run a query.

    此查詢會傳回與第一個查詢相同的記錄,但是只包含 project 陳述式中指定的資料行。This query returns the same records as the first one, but includes only the columns specified in the project statement. 結果應該會類似於下列表格。The result should look like the following table.

    查詢結果集

  6. 在查詢視窗頂端,選取 [召回] 。At the top of the query window, select Recall.

    查詢視窗現在會顯示第一個查詢的結果,無需重新執行查詢。The query window now shows the result set from the first query without having to rerun the query. 通常在分析期間,您可以執行多個查詢,而 [召回] 可讓您重新瀏覽上一個查詢的結果。Often during analysis, you run multiple queries, and Recall enables you to revisit the results of previous queries.

  7. 讓我們再執行一個查詢來查看不同的輸出類型。Let's run one more query to see a different type of output.

    StormEvents
    | summarize event_count=count(), mid = avg(BeginLat) by State
    | sort by mid
    | where event_count > 1800
    | project State, event_count
    | render columnchart
    

    結果應會類似於下列圖表。The result should look like the following chart.

    直條圖

使用資料表格線Work with the table grid

現在您已了解基本查詢的運作方式,讓我們看看如何使用資料表格線來自訂結果和執行進一步分析。Now you've seen how basic queries work, let's look at how you can use the table grid to customize results and do further analysis.

  1. 重新執行第一個查詢。Rerun the first query. 讓滑鼠停留在 State 資料行上,選取功能表,然後選取 Group by StateMouse-over the State column, select the menu, and select Group by State.

    依狀態分組

  2. 在方格中,展開 California 以查看該狀態的記錄。In the grid, expand California to see records for that state.

    查詢結果集

    執行探勘分析時,這種分組類型很有幫助。This type of grouping can be helpful when doing exploratory analysis.

  3. 將滑鼠停留在 Group 資料行上,然後選取 Reset columnsMouse-over the Group column, then select Reset columns.

    重設資料行

    這會讓格線回到其原始狀態。This returns the grid to its original state.

  4. 執行下列查詢。Run the following query.

    StormEvents
    | sort by StartTime desc
    | where DamageProperty > 5000
    | project StartTime, State, EventType, DamageProperty, Source
    | take 10
    
  5. 在方格的右側,選取 Columns 以查看工具面板。On the right side of the grid, select Columns to see the tool panel.

    工具面板

    此面板的功能類似於 Excel 中的樞紐資料表的欄位清單,能讓您在格線本身執行更多分析。This panel functions similarly to the pivot table field list in Excel, enabling you to do more analysis in the grid itself.

  6. 選取 [樞紐分析表模式],然後拖曳資料行,如下所示:[狀態] 到 [資料列群組];[DamageProperty] 到 [值];[EventType] 到 [資料行標籤]。Select Pivot Mode, then drag columns as follows: State to Row groups; DamageProperty to Values; and EventType to Column labels.

    樞紐分析表模式

    結果應該會類似於下列樞紐分析表。The result should look like the following pivot table.

    樞紐分析表

    請注意 Vermont 和 Alabama 在相同的類別中各有兩個事件,而 Texas 在不同的類別下則有兩個事件。Notice how Vermont and Alabama each have two events under the same category, while Texas has two events under different categories. 樞紐分析表可讓您快速找出這類事情,它們是進行快速分析的絕佳工具。Pivot tables enable you to quickly spot things like this; they are a great tool for quick analysis.

共用查詢Share queries

許多時候,您會想要共用所建立的查詢。Many times, you want to share the queries you create. 您可以提供深層連結,讓其他能夠存取叢集的使用者也能執行查詢。You can provide a deep link so that other users with access to the cluster can run the queries.

  1. 在查詢視窗中,選取您所複製的第一個查詢。In the query window, select the first query you copied in.

  2. 在查詢視窗頂端,選取 [共用] 。At the top of the query window, select Share.

  3. 選取 [Link, query to clipboard]。Select Link, query to clipboard.

  4. 複製連結和查詢到文字檔。Copy the link and query to a text file.

  5. 將連結貼到新的瀏覽器視窗。Paste the link into a new browser window. 查詢執行之後,結果應該會看起來如下所示。The result should look like the following after the query runs.

    共用的查詢

提供意見反應Provide feedback

資料總管目前為預覽狀態,我們歡迎您針對使用提出意見反應。Data Explorer is currently in preview, and we welcome feedback on your experience. 您可以立即執行此作業,或等到您有更多時間可以執行。You can do this now or wait until you've spent more time with it.

  1. 在應用程式右上角,選取意見反應圖示:In the upper-right of the application, select the feedback icon: 意見反應圖示上也提供本文中使用的原始碼。.

  2. 輸入您的意見反應,然後選取 [提交]。Enter your feedback, then select Submit.

清除資源Clean up resources

您並未在此快速入門中建立任何資源,但若您要從應用程式移除一或兩個叢集,請以滑鼠右鍵按一下叢集,然後選取 [移除連線]。You didn't create any resources in this quickstart, but if you'd like to remove one or both clusters from the application, right-click the cluster and select Remove connection.

後續步驟Next steps