Skip to content

Source and Collector Wise Cardinality - doc update #6660

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
JV0812 wants to merge 6 commits into
base: main
Choose a base branch
from
Open

Source and Collector Wise Cardinality - doc update #6660

Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
30b4504
Source and Collector Wise Cardinality - doc update
JV0812 May 7, 2026
abc4190
minor fix
JV0812 May 7, 2026
23109bd
minor fix
JV0812 May 7, 2026
cab7e62
Apply suggestion from @kimsauce
JV0812 May 11, 2026
696830a
Apply suggestion from @JV0812
JV0812 May 11, 2026
41a1e5e
Update source-and-collector-cardinality.md
JV0812 May 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 9 additions & 6 deletions docs/metrics/source-and-collector-cardinality.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,21 +18,24 @@ This feature is in Private Preview. For more information, contact your Sumo Logi

This document explains how to identify and analyze cardinality ingested per source and collector, helping you pinpoint high-cardinality sources and manage ingestion limits more effectively.

Previously, there was no direct visibility into the contribution of cardinality from individual sources. When limits were exceeded, there was limited control over which sources were paused. As a result, sources that were not significant contributors could be paused, while the actual high-cardinality sources remained active. This lack of source-level visibility made it difficult to accurately identify and address the root cause of high cardinality.
Previously, there was no direct visibility into the contribution of cardinality from individual sources. When limits were exceeded, there was limited control over which sources were paused. As a result, [sources that were not significant contributors could be paused](/docs/metrics/manage-metric-volume/disabled-metrics-sources/), while the actual high-cardinality sources remained active. This lack of source-level visibility made it difficult to accurately identify and address the root cause of high cardinality.

To address this, you can now run a query to identify cardinality at the source level and analyze which sources contribute the most within a given collector. This enables more targeted actions and helps avoid unnecessary impact on other sources.
To address this, you can now run a query to identify total cardinality and cardinality at the source level and analyze which sources contribute the most within a given collector. This enables more targeted actions and helps avoid unnecessary impact on other sources.

Use the query below to determine the cardinality associated with sources for a specific collector.

```sql
_view=sumologic_volume _sourceCategory=cardinalityPerSourceCollector
| parse regex "bucket:\s+(?<bucket>\S+)" nodrop
| parse regex "(?<collectorId>[^;\s]+);(?<sourceId>\d+):(?<cardinality>\d+)" multi
| num(cardinality)
| fields bucket, collectorId, sourceId, cardinality
| parse regex "bucket:\s+(?<bucket>[^,\s]+), totalCardinality: (?<totalCardinality>\d+)"
| parse regex "(?<collectorName>[^;\s]+);(?<sourceName>[^:]+?):(?<sourceCardinality>\d+)" multi nodrop
| num(sourceCardinality)
| num(totalcardinality )
| fields bucket, collectorName, sourceName, sourceCardinality, totalCardinality
```

## Limitations

* If an organization has more than 100 sources, only the top 100 sources (by cardinality) are displayed for an audit log.
* Source and collector data is refreshed every hour, and a new audit log is generated to reflect the latest cardinality data.
* The sum of individual sources may not match the total cardinality count. This is because tracing-to-metrics conversions and internal metrics are excluded from individual source counts.