LokqlDx tutorial ‐ quick start
This tutorial is intended to show you the very basics of loading, querying and and saving data within LokqlDx.
If you downloaded the prebuilt-binaries, you will find a "tutorials" folder within the zip file, otherwise you can download the material from the tutorials section of the repository.
Note you'll need to download both the quickstart.lokqldx workspace and the traffic.csv dataset and store them in the same folder.
Open the lokqlDx application and use the "File->Open Workspace" menu to load the quickstart workspace.
After loading the application, you should see something like this...
The section on the top left is the query editor where you can enter and execute commands and KQL queries.
Commands are distinguished by starting with a leading period. KQL queries are simply entered "in-line" and can span multiple lines long as they don't contain a blank line.
To execute a command or query, you can move the text cursor to any position on any non-blank line and press the SHIFT and ENTER keys at the same time. (For more information see running queries and commands.)
Let's start by clicking on the print "Hello KQL" line to position the text cursor then pressing SHIFT-ENTER.
You should notice that the section of the display on the right now shows "hello KQL"
That's because print is a KQL "query" that simply returns a single-cell result containing the object that was passed in. The data display is actually a datagrid and print_0 is the name of the column that the print function generates.
Data is generally loaded into lokqlDx using the .load command. When a workspace is loaded, the default "working directory" is set to the folder that contains the workspace so a relative path such as "traffic.csv" will refer to a file contained in the same folder as the workspace. You can use fully-qualified paths or even drag-and-drop a data file into the query editor to generate a .load command that contains the path to the file but in this case we'll just use the supplied data file.
Move the cursor over the load command and press SHIFT-ENTER to execute it.
At the bottom of the screen you should see output like this...
That tells us the CSV file was correctly loaded into an internal table called "traffic". By default table-names are simply generated from the file-name but you can change this by supplying a second parameter to the .load command which is the desired table name.
lokqlDx will attempt to infer the types of columns in a CSV file rather than treating them all as strings so we can start working with the data straight-away. You can check the names and types of each of the columns by executing the traffic | getschema query...
To see the data in the table you can simply execute the table-name as a query (traffic)
lokqlDx can generate charts from the KQL render command. If you execute this query:
# plot distance covered by vehicle type
traffic
| summarize TotalDistance = sum(Distance)
by Year,Vehicle
| project Year,TotalDistance,Vehicle
| render linechartyou should see this chart
Unsurprisingly there was a big dip in motor traffic during 2020 !
This isn't intended to be a tutorial on KQL but if you're curious about what's going on here, the summarize command is adding together the Distance value for all rows with the same combination of Year and Vehicle then we're re-ordering the columns using the project operator and finally using the render command to generate the chart.
Although we've generated a chart, the underlying data is still available. In fact if you click on the Data tab view you can see it...
lokqlDx remembers the results of the last query you ran and many commands implicitly refer to this.
If you execute the .save c:\temp\distance_by_vehicle_type.csv command after running the chart query, you should see that a new csv file is created at the specified path and that it contains the same data as shown in the Data display.