Kusto.Explorer installation and user interface

Applies to: ✅ Microsoft Fabric ✅ Azure Data Explorer

Kusto.Explorer is free software for download and use on your Windows desktop. Kusto.Explorer allows you to query and analyze your data with Kusto Query Language (KQL) in a user-friendly interface. This overview explains how to set up Kusto.Explorer, and describes the user interface you'll use.

With Kusto.Explorer, you can:

• Query your data.
• Search your data across tables.
• Visualize your data in a wide variety of graphs.
• Share queries and results by email or using deep links.

Installing Kusto.Explorer

• Download and install the Kusto.Explorer tool from:

  • https://aka.ms/ke

• Alternatively, access your Kusto cluster with a ClickOnce-enabled browser at: https://<your_cluster>/?web=0 Replace <your_cluster> with your cluster URI (for example, help.kusto.windows.net.)

Using Google Chrome and Kusto.Explorer

If Google Chrome is your default browser, installing the ClickOnce extension for Chrome is required. https://chromewebstore.google.com/detail/clickonce-for-google-chro/kekahkplibinaibelipdcikofmedafmb?hl=en-US

If your default browser is the Microsoft Edge, installing this extension isn't required. Validate your ClickOnce settings in Microsoft Edge flag settings.

Overview of the user interface

The Kusto.Explorer user interface is designed with a layout based on tabs and panels, similar to that of other Microsoft products:

• Navigate through the tabs on the menu panel to perform various operations
• Manage your connections in the connections panel
• Create scripts to run in the script panel
• View the results of the scripts in the results panel

Connections panel

The Connections pane shows all the configured cluster connections. For each cluster the databases, tables, and attributes (columns) that they store are shown. Select items (which sets an implicit context for the search/query in the main panel), or double-click items to copy the name to the search/query panel.

If the actual schema is large (such as a database with hundreds of tables), you can search it by pressing CTRL+F and entering a substring (case-insensitive) of the entity name you're looking for.

Kusto.Explorer supports controlling the Connection panel from the query window, which is useful for scripts. For example, you can start a script file with a command that instructs Kusto.Explorer to connect to the cluster/database the script queries, using the following syntax:

#connect cluster('help').database('Samples')

StormEvents | count

Run each line using F5, or similar.

Work Documents panel

The Work folders pane organizes your work folders in one place to make navigating your work easier. There are two types of work folders:

• Unsaved work: lists folders for open query tabs that you may still be working on.
• Tracked folders: lists folders from your local device that you can add as KQL libraries for easier access and management.

Menu panel

Home tab

The Home tab shows the most frequently used operations. It includes:

Query section

Menu	Behavior
Mode dropdown	Query mode: Switches the query editor into a query mode. Commands can be written and saved as queries (default) Search mode: A single query mode where each command entered is processed immediately and presents a result in the result panel Search++ mode: Allows searching for a term using search syntax across one or more tables. Learn more about using Search++ Mode
New Tab	Opens a new tab for querying Kusto Query Language.

Share section

Menu	Behavior
Data To Clipboard	Exports Query and dataset to a clipboard. If a chart is presented, it exports the chart as bitmap
Result To Clipboard	Exports the dataset to a clipboard. If a chart is presented, it exports the chart as bitmap
Query to Clipboard	Exports the Query to a clipboard

Visualizations section

For variable visualizations, see the render operator.

Menu	Behavior
Area chart	Displays an area chart in which the X-axis is the first column (must be numeric). All numeric columns are mapped to different series (Y-axis).
Column Chart	Displays a column chart where all numeric columns are mapped to different series (Y-axis). The text column before numeric is the X-axis (can be controlled in the UI).
Bar Chart	Displays a bar chart where all numeric columns are mapped to different series (X-axis). The text column before numeric is the Y-axis (can be controlled in the UI).
Stacked Area Chart	Displays a stacked area chart in which the X-axis is the first column (must be numeric). All numeric columns are mapped to different series (Y-axis).
Time Chart	Displays a time chart in which the X-axis is the first column (must be datetime). All numeric columns are mapped to different series (Y-axis).
Line Chart	Displays a line chart in which the X-axis is the first column (must be numeric). All numeric columns are mapped to different series (Y-axis).
Anomaly Chart	Similar to Time Chart, but finds anomalies in time series data, using a machine learning anomaly detection algorithm. The data must be in fixed interval buckets. For anomaly detection, Kusto.Explorer uses the series_decompose_anomalies function.
Pie Chart	Displays a pie chart in which the color-axis is the first column. The theta-axis (must be a measure, converted to percent) is the second column.
Time Ladder	Displays a ladder chart in which the X-axis is the last two columns (must be datetime). The Y-axis is a composite of the other columns.
Scatter Chart	Displays a point graph in which the X-axis is the first column (must be numeric). All numeric columns are mapped to different series (Y-axis).
Pivot Chart	Displays a pivot table and pivot chart that gives the full flexibility of selecting data, columns, rows, and various chart types.
Time Pivot	Interactive navigation over the events time-line (pivoting on time axis)

View section

Menu	Behavior
Full View Mode	Maximizes the work space by hiding the ribbon menu and Connection Panel. Exit Full View Mode by selecting Home > Full View Mode, or by pressing F11.
Hide Empty Columns	Removes empty columns from the data grid.
Collapse Singular Columns	Collapses columns with singular values.
Explore Column Values	Shows column values distribution
Increase Font	Increases the font size of the query tab and of the results data grid.
Decrease Font	Decreases the font size of the query tab and of the results data grid.

Note

Data View Settings:

Kusto.Explorer keeps track of what settings are used per unique set of columns. When columns are reordered or removed, the data view is saved and will be reused whenever the data with the same columns is retrieved. To reset the view to its defaults, in the View tab, select Reset View.

File tab

Menu	Behavior
	---------Query Script---------
New Tab	Opens a new tab window for querying Kusto.
Open File	Loads data from a *.kql file to the active script panel.
Save To File	Saves the content of the active script panel to *.kql file.
Close Tab	Closes the current tab window
	---------Profiles---------
Import Profile	Import a Kusto.Explorer profile.
Export Profile	Export a Kusto.Explorer profile.
	---------Save Data---------
Data To CSV	Exports data to a CSV (comma-separated-values) file.
Data To JSON	Exports data to a JSON formatted file.
Data To Excel	Exports data to an XLSX (Excel) file.
Data To Text	Exports data to a TXT (text) file.
Data To KQL Script	Exports Query to a script file.
Data To Results	Exports Query and data to a Results (QRES) file.
Run Query Into CSV	Runs a query and saves the results to a local CSV file.
	---------Load Data---------
From Results	Loads Query and data from a Results (QRES) file.
	---------Clipboard---------
Query and Results To Clipboard	Exports Query and dataset to a clipboard. If a chart is presented, it exports the chart as a bitmap.
Result To Clipboard	Exports dataset to a clipboard. If a chart is presented, it exports the chart as a bitmap.
Query To Clipboard	Exports the Query to a clipboard.
Results To Clipboard (datatable())	Exports query results to a clipboard. Maximal allowed cell value is 30000.
	---------Results---------
Clear results cache	Clears cached results of previously executed queries.

Connections tab

Menu	Behavior
	---------Groups---------
Add Group	Adds a new Kusto Server group.
	---------Clusters---------
Import Connections	Imports connections from a file specifying connections.
Export Connections	Exports connections to a file.
Add Connection	Adds a new Kusto Server connection.
Edit Connection	Opens a dialog for Kusto Server connection properties editing.
Remove Connection	Removes the existing connection to Kusto Server.
Refresh	Refreshes properties of a Kusto server connection.
	---------Profiles---------
Import Profile	Import a Kusto.Explorer profile.
Export Profile	Export a Kusto.Explorer profile.
	---------Security---------
Inspect Your ADD Principal	Shows currents active user details.
Sign-out	Signs-out the current user from the connection to Microsoft Entra ID.
	---------Data Scope---------
Caching scope	Hot DataExecute queries only on hot data cache All Data: Execute queries on all available data (default).
DateTime Column	Name of a column that may be used for time pre-filter.
Time Filter	Value of time pre-filter.

View tab

Menu	Behavior
	---------Appearance---------
Full View Mode	Maximizes the work space by hiding the ribbon menu and Connection Panel. Exit Full View Mode by selecting Home > Full View Mode, or by pressing F11.
Increase Font	Increases the font size of the query tab and of the results data grid.
Decrease Font	Decreases the font size of the query tab and of the results data grid.
Reset Layout	Resets the layout of the tool's docking controls and windows.
Rename Document Tab	Rename the selected tab.
	---------Data View---------
Reset View	Resets data view settings to its defaults.
Explore Column Values	Shows column values distribution.
Focus on Query Statistics	Changes the focus to query statistics instead of query results upon query completion.
Hide Duplicates	Toggles removal of the duplicate rows from the query results.
Hide Empty Columns	Removes empty columns from the query results.
Collapse Singular Columns	Collapses columns with singular values.
Row Selection	Enables selection of specific rows in the Results panel
Color By Column	Groups identical records in the first column by color.
Wrap Text	Formats cells to wrap the data to fit the column width.
	---------Data Filtering---------
Filter Rows In Search	Toggles the option to show only matching rows in query results search (Ctrl+F).
	---------Visualizations---------
Visualizations	See Visualizations.

Note

Data View Settings:

Kusto.Explorer keeps track of the settings used per unique set of columns. When columns are reordered or removed, the data view is saved and will be reused whenever the data with the same columns is retrieved. To reset the view to its defaults, in the View tab, select Reset View.

Tools tab

Menu	Behavior
	---------IntelliSense---------
Enable IntelliSense	Enables and disables IntelliSense on the Script Panel.
Issues List	Lists issues in the Script panel.
	---------Automation---------
Add New Automation	Produces an analysis report that provides insights about the query.
	---------Utilities---------
Command-line tools	Opens the command prompt on your computer.
Compress LZ4 file	Compresses files using the LZ4 algorithm.
Decompress LZ4 file	Decompresses files using the LZ4 algorithm.
	---------Analytics---------
Analytical Reports	Opens a dashboard with multiple pre-built reports for data analysis.
	---------Translate---------
Query to Power BI	Translates a query to a format suitable for using in Power BI.
	---------Options---------
Reset Options	Sets application settings to default values.
Options	Opens a tool for configuring application settings. To learn more, see Kusto.Explorer options.

Table row colors

Kusto.Explorer tries to interpret the severity or verbosity level of each row in the results panel and color them accordingly. It does this by matching the distinct values of each column with a set of known patterns ("Warning," "Error," and so on).

To modify the output color scheme, or turn off this behavior, from the Tools menu, select Options > Results Viewer > Verbosity color scheme.

Excel color scheme legend	Vivid color scheme legend

Monitoring tab

Menu	Behavior
	---------Monitor---------
Cluster Diagnostics	Shows a health summary for the Server Group currently selected in Connections Panel.
Latest data: All tables	Shows a summary of the latest data in all tables of the currently selected database.
Latest data: Selected table	Shows in the status bar the latest data in the selected table.

Management tab

Menu	Behavior
	---------Authorized Principals---------
Manage Database Authorized Principals	Enables managing a database's principals for authorized users.
Manage Table Authorized Principals	Enables managing a table's principals for authorized users.
Manage Function Authorized Principals	Enables managing a function's principals for authorized users.

Help tab

Menu	Behavior
	---------Documentation---------
Help	Opens a link to the Kusto online documentation.
What's new	Opens a document that lists all Kusto.Explorer changes.
Report Issue	Opens a dialog with two options: Report issues related to service Report issues in the client application .
Keyboard Shortcuts	Opens a link to the list of Kusto.Explorer keyboard shortcuts.
Show EULA	Opens a link to the Microsoft Azure Legal Information article.

Control the user identity connecting to Kusto.Explorer

The default security model for new connections is Microsoft Entra ID-Federated security. Authentication is done through the Microsoft Entra ID using the default Microsoft Entra user experience.

If you need finer control over the authentication parameters, you can expand the "Advanced: Connection Strings" edit box and provide a valid Kusto connection string value.

For example, users with a presence in multiple Microsoft Entra tenants sometimes need to use a particular "projection" of their identities to a specific Microsoft Entra tenant, which can be done through the connection string (replace words IN CAPITALS with specific values):

Data Source=https://CLUSTER_NAME.kusto.windows.net;Initial Catalog=DATABASE_NAME;AAD Federated Security=True;Authority Id=AAD_TENANT_OF_CLUSTER;User=USER_DOMAIN

• AAD_TENANT_OF_CLUSTER is a domain name or Microsoft Entra tenant ID (a GUID) of the tenant in which the cluster is hosted. For example, contoso.com.
• USER_DOMAIN is the identity of the user invited into that tenant (for example, user@example.com).

Note

The domain name of the user is not necessarily the same as that of the tenant hosting the cluster.

Related content

• Using Kusto.Explorer
• Kusto.Explorer keyboard shortcuts
• Kusto.Explorer options
• Troubleshooting Kusto.Explorer
• Kusto.Explorer code features
• Kusto Query Language (KQL)