Skip to main content
Managing the cardinality of persisted data can be challenging when determining which metrics to send to Palo Alto Networks Cortex XCOR. Metric cardinality is the number of unique time series produced by a combination of metric names and their associated labels. Cardinality is the total number of these combinations. The more combinations there are, the greater a metric’s cardinality is, and the more data Cortex XCOR persists. This can affect your license.
Learn about strategies and tools you can use to reduce cardinality.
Cortex XCOR includes various shaping rules to manipulate the data you send to Cortex XCOR. Use metric shaping rules to reduce the metrics you store in Cortex XCOR, optimize query performance, and create aliases for expressions.

​
Downsample data

Collectors ingest metrics at specific intervals, based on system configuration. This granularity of metric data can be helpful in diagnostic efforts, but certain issues might not be served by such granularity. If you can diagnose production issues by using a coarser granularity of metric data, downsampling the data reduces the amount of data persisted to the Cortex XCOR database. Downsample incoming data in Cortex XCOR using these methods:
  • Change the Chronosphere Collector configuration by changing the rate at which the Chronosphere Collector publishes metrics to the server.
  • Use mapping rules to downsample metrics that aren’t aggregated.
  • Use rollup rules to downsample aggregated metrics.
Over time, persisted data uses significant storage capacity. Cortex XCOR performs long-term downsampling to control data storage costs while retaining important statistics. Be aware that late-arriving data can affect downsampling.