The transition to cloud-native architectures has led to an explosion in metrics data, both in volume and cardinality. This necessitates the development of monitoring systems capable of managing large-scale, high-cardinality data to achieve effective observability in these environments.
In this blog post, we’ll explore the important role of cardinality in monitoring and observability.
Cardinality is a mathematics term that refers to the number of unique elements in a set. It is a concept deeply rooted in set theory, a branch of mathematical logic that studies collections of objects. In the context of data, cardinality refers to the uniqueness of data values contained in a particular column of a database table.
Cardinality in databases is important for several reasons:
Within database design and data modeling, cardinality is used to describe the relationship between tables in a database. It can be categorized into high and low cardinality. High cardinality is present when a column or row in a database has many distinct values, whereas low cardinality involves many repeated values. The relationships in a database cardinality can be one-to-one, many-to-many, and one-to-many.
Each of these relationships serves a unique purpose in data modeling, ensuring that the integrity and structure of the data are maintained and accurately represent the real-world entities and their interactions they are designed to model.
In monitoring systems, especially in cloud-native and microservices environments, cardinality denotes the number of individual values of a metric. For instance, if an application has two HTTP methods, GET and POST, its cardinality is 2. This concept is crucial in modern monitoring systems due to the vast amount of operational data generated, requiring systems that can manage data with higher cardinality effectively.
Cardinality in monitoring and observability enhances the capacity to gather, analyze, and utilize data to maintain system performance, stability, and efficiency. Cardinality enables:
High cardinality refers to a situation where a data attribute or column in a dataset has a large number of distinct values. For example, in a user database, attributes such as user IDs or email addresses typically have high cardinality, as each user has a unique identifier. High cardinality fields are powerful for detailed data analysis and troubleshooting in monitoring and observability systems, as they enable granular tracking of individual records or events. However, managing high cardinality data can be challenging due to the storage requirements and the complexity of queries needed to analyze such diverse data. In an online shopping system, for example, fields like user IDs and order IDs typically have high cardinality, possibly encompassing hundreds of thousands of unique values.
Cardinality metrics are the metrics that reflect the count of distinct values in a dataset or column. In monitoring systems, these metrics often translate to the unique combinations of metric names and their associated labels or dimensions. High cardinality metrics allow for detailed analysis and troubleshooting but can also lead to challenges in data management and query performance.
High cardinality metrics can be challenging to manage due to the significant increase in the number of time series stored and the complexity of the required queries. Splunk Observability solutions address these challenges by allowing queries over a large number of metric time series without performance penalties and treating all dimensions and tags equally for efficient searches.
The ability to rapidly analyze high cardinality fields is key to effective observability. It enables the identification of specific issues and their causes, such as pinpointing a user or a particular endpoint causing problems. Platforms like Splunk are designed to handle high cardinality and high dimensionality data, allowing users to freely query and filter on any attribute regardless of its cardinality.
Cardinality metrics are an essential aspect of modern monitoring and observability, particularly in cloud-native environments where data volume and diversity are substantial. Understanding and effectively managing these metrics is crucial for maintaining efficient and reliable monitoring systems.
See an error or have a suggestion? Please let us know by emailing ssg-blogs@splunk.com.
This posting does not necessarily represent Splunk's position, strategies or opinion.
The Splunk platform removes the barriers between data and action, empowering observability, IT and security teams to ensure their organizations are secure, resilient and innovative.
Founded in 2003, Splunk is a global company — with over 7,500 employees, Splunkers have received over 1,020 patents to date and availability in 21 regions around the world — and offers an open, extensible data platform that supports shared data across any environment so that all teams in an organization can get end-to-end visibility, with context, for every interaction and business process. Build a strong data foundation with Splunk.