From 30b45042b2c3a2ede2c8af7d989b469b5654931b Mon Sep 17 00:00:00 2001 From: Jagadisha V Date: Thu, 7 May 2026 12:42:00 +0530 Subject: [PATCH 1/6] Source and Collector Wise Cardinality - doc update --- docs/metrics/source-and-collector-cardinality.md | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/docs/metrics/source-and-collector-cardinality.md b/docs/metrics/source-and-collector-cardinality.md index 544688c373..7301f64c6d 100644 --- a/docs/metrics/source-and-collector-cardinality.md +++ b/docs/metrics/source-and-collector-cardinality.md @@ -26,13 +26,16 @@ Use the query below to determine the cardinality associated with sources for a s ```sql _view=sumologic_volume _sourceCategory=cardinalityPerSourceCollector - | parse regex "bucket:\s+(?\S+)" nodrop - | parse regex "(?[^;\s]+);(?\d+):(?\d+)" multi + | parse regex "bucket:\s+(?[^,\s]+), totalCardinality: (?\d+)" + | parse regex "(?[^;\s]+);(?[^:]+?):(?\d+)" multi | num(cardinality) - | fields bucket, collectorId, sourceId, cardinality + | num(totalcardinality ) + | fields bucket, collectorName, sourceName, cardinality,totalCardinality ``` ## Limitations * If an organization has more than 100 sources, only the top 100 sources (by cardinality) are displayed for an audit log. * Source and collector data is refreshed every hour, and a new audit log is generated to reflect the latest cardinality data. +* The sum of individual sources may not match the total cardinality count. This is because tracing-to-metrics conversions and internal metrics are excluded from individual source counts. + From abc4190247020dacd8735160b56d1219361068af Mon Sep 17 00:00:00 2001 From: Jagadisha V Date: Thu, 7 May 2026 13:44:31 +0530 Subject: [PATCH 2/6] minor fix --- docs/metrics/source-and-collector-cardinality.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/docs/metrics/source-and-collector-cardinality.md b/docs/metrics/source-and-collector-cardinality.md index 7301f64c6d..2942182173 100644 --- a/docs/metrics/source-and-collector-cardinality.md +++ b/docs/metrics/source-and-collector-cardinality.md @@ -20,17 +20,17 @@ This document explains how to identify and analyze cardinality ingested per sour Previously, there was no direct visibility into the contribution of cardinality from individual sources. When limits were exceeded, there was limited control over which sources were paused. As a result, sources that were not significant contributors could be paused, while the actual high-cardinality sources remained active. This lack of source-level visibility made it difficult to accurately identify and address the root cause of high cardinality. -To address this, you can now run a query to identify cardinality at the source level and analyze which sources contribute the most within a given collector. This enables more targeted actions and helps avoid unnecessary impact on other sources. +To address this, you can now run a query to identify total cardinality and cardinality at the source level and analyze which sources contribute the most within a given collector. This enables more targeted actions and helps avoid unnecessary impact on other sources. Use the query below to determine the cardinality associated with sources for a specific collector. ```sql _view=sumologic_volume _sourceCategory=cardinalityPerSourceCollector - | parse regex "bucket:\s+(?[^,\s]+), totalCardinality: (?\d+)" - | parse regex "(?[^;\s]+);(?[^:]+?):(?\d+)" multi - | num(cardinality) - | num(totalcardinality ) - | fields bucket, collectorName, sourceName, cardinality,totalCardinality +| parse regex "bucket:\s+(?[^,\s]+), totalCardinality: (?\d+)" +| parse regex "(?[^;\s]+);(?[^:]+?):(?\d+)" multi +| num(sourceCardinality) +| num(totalcardinality ) +| fields bucket, collectorName, sourceName, sourceCardinality, totalCardinality ``` ## Limitations From 23109bd5f46e94d9f3d63c382dbc7d9dafbb3b0f Mon Sep 17 00:00:00 2001 From: Jagadisha V Date: Thu, 7 May 2026 13:50:41 +0530 Subject: [PATCH 3/6] minor fix --- docs/metrics/source-and-collector-cardinality.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/metrics/source-and-collector-cardinality.md b/docs/metrics/source-and-collector-cardinality.md index 2942182173..61533114d5 100644 --- a/docs/metrics/source-and-collector-cardinality.md +++ b/docs/metrics/source-and-collector-cardinality.md @@ -18,7 +18,7 @@ This feature is in Private Preview. For more information, contact your Sumo Logi This document explains how to identify and analyze cardinality ingested per source and collector, helping you pinpoint high-cardinality sources and manage ingestion limits more effectively. -Previously, there was no direct visibility into the contribution of cardinality from individual sources. When limits were exceeded, there was limited control over which sources were paused. As a result, sources that were not significant contributors could be paused, while the actual high-cardinality sources remained active. This lack of source-level visibility made it difficult to accurately identify and address the root cause of high cardinality. +Previously, there was no direct visibility into the contribution of cardinality from individual sources. When limits were exceeded, there was limited control over which sources were paused. As a result, [sources that were not significant contributors could be paused](/docs/metrics/manage-metric-volume/disabled-metrics-sources/), while the actual high-cardinality sources remained active. This lack of source-level visibility made it difficult to accurately identify and address the root cause of high cardinality. To address this, you can now run a query to identify total cardinality and cardinality at the source level and analyze which sources contribute the most within a given collector. This enables more targeted actions and helps avoid unnecessary impact on other sources. From cab7e6294e0680ba6f7dc8eb379af278a528509a Mon Sep 17 00:00:00 2001 From: Jagadisha V <129049263+JV0812@users.noreply.github.com> Date: Mon, 11 May 2026 10:59:42 +0530 Subject: [PATCH 4/6] Apply suggestion from @kimsauce Co-authored-by: Kim Pohas <56411016+kimsauce@users.noreply.github.com> --- docs/metrics/source-and-collector-cardinality.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/metrics/source-and-collector-cardinality.md b/docs/metrics/source-and-collector-cardinality.md index 61533114d5..6a982a69b9 100644 --- a/docs/metrics/source-and-collector-cardinality.md +++ b/docs/metrics/source-and-collector-cardinality.md @@ -29,7 +29,7 @@ _view=sumologic_volume _sourceCategory=cardinalityPerSourceCollector | parse regex "bucket:\s+(?[^,\s]+), totalCardinality: (?\d+)" | parse regex "(?[^;\s]+);(?[^:]+?):(?\d+)" multi | num(sourceCardinality) -| num(totalcardinality ) +| num(totalCardinality) | fields bucket, collectorName, sourceName, sourceCardinality, totalCardinality ``` From 696830acfdd36f390579fb4e8230fc256972d952 Mon Sep 17 00:00:00 2001 From: Jagadisha V <129049263+JV0812@users.noreply.github.com> Date: Mon, 11 May 2026 12:42:15 +0530 Subject: [PATCH 5/6] Apply suggestion from @JV0812 --- docs/metrics/source-and-collector-cardinality.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/metrics/source-and-collector-cardinality.md b/docs/metrics/source-and-collector-cardinality.md index 6a982a69b9..6bc418cd84 100644 --- a/docs/metrics/source-and-collector-cardinality.md +++ b/docs/metrics/source-and-collector-cardinality.md @@ -26,7 +26,7 @@ Use the query below to determine the cardinality associated with sources for a s ```sql _view=sumologic_volume _sourceCategory=cardinalityPerSourceCollector -| parse regex "bucket:\s+(?[^,\s]+), totalCardinality: (?\d+)" +| parse regex "bucket:\s+(?[^,\s]+), totalCardinality: (?\d+)" nodrop | parse regex "(?[^;\s]+);(?[^:]+?):(?\d+)" multi | num(sourceCardinality) | num(totalCardinality) From 41a1e5e45bd79aa64c5e9d9b145f480ae6bb93fb Mon Sep 17 00:00:00 2001 From: Jagadisha V <129049263+JV0812@users.noreply.github.com> Date: Mon, 11 May 2026 12:46:48 +0530 Subject: [PATCH 6/6] Update source-and-collector-cardinality.md --- docs/metrics/source-and-collector-cardinality.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/metrics/source-and-collector-cardinality.md b/docs/metrics/source-and-collector-cardinality.md index 6bc418cd84..2cd344fd61 100644 --- a/docs/metrics/source-and-collector-cardinality.md +++ b/docs/metrics/source-and-collector-cardinality.md @@ -26,10 +26,10 @@ Use the query below to determine the cardinality associated with sources for a s ```sql _view=sumologic_volume _sourceCategory=cardinalityPerSourceCollector -| parse regex "bucket:\s+(?[^,\s]+), totalCardinality: (?\d+)" nodrop -| parse regex "(?[^;\s]+);(?[^:]+?):(?\d+)" multi +| parse regex "bucket:\s+(?[^,\s]+), totalCardinality: (?\d+)" +| parse regex "(?[^;\s]+);(?[^:]+?):(?\d+)" multi nodrop | num(sourceCardinality) -| num(totalCardinality) +| num(totalcardinality ) | fields bucket, collectorName, sourceName, sourceCardinality, totalCardinality ```