--- title: Cisco IT’s Endpoint Observability Strategy: Right-Sized... description: Cisco IT cut endpoint telemetry volume by 75% by right-sizing what it collects through Splunk Observability Cloud. The team catalogued every metric from the... canonical: https://daily.dev/posts/cisco-it-s-endpoint-observability-strategy-right-sized-telemetry-for-splunk-observability-cloud-ooczm2ilx twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Cisco IT’s Endpoint Observability Strategy: Right-Sized Telemetry for Splunk Observability Cloud | daily.dev og:description: Cisco IT cut endpoint telemetry volume by 75% by right-sizing what it collects through Splunk Observability Cloud. The team catalogued every metric from the... og:url: https://daily.dev/posts/cisco-it-s-endpoint-observability-strategy-right-sized-telemetry-for-splunk-observability-cloud-ooczm2ilx og:image: https://api.daily.dev/og/posts/oOcZM2ILX.png og:image:alt: Cisco IT’s Endpoint Observability Strategy: Right-Sized Telemetry for Splunk Observability Cloud og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Cisco IT’s Endpoint Observability Strategy: Right-Sized Telemetry for Splunk Observability Cloud **[Cisco](https://daily.dev/sources/cisco)** · 6 min read · 0 upvotes · 0 comments ## Summary Cisco IT cut endpoint telemetry volume by 75% by right-sizing what it collects through Splunk Observability Cloud. The team catalogued every metric from the Splunk OpenTelemetry Collector across macOS, Windows, and Linux, then filtered candidates by actionability, utility, efficiency, and scope. Moving from the Collector's default 10-second interval to a 60-second interval can, in the team's modeling, cut datapoint volume by up to 75%. Process monitoring is scoped to apps like Webex, Duo, and Cisco Collab Host instead of every running process, and high-cardinality data moves to logs instead of metrics. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How much can increasing the Splunk OpenTelemetry Collector's metric interval from 10 seconds to 60 seconds reduce data volume? Increasing the collection interval from the Collector's default 10 seconds to 60 seconds can cut datapoint volume by up to 75% in endpoint telemetry modeling. This was one of eight strategies Cisco IT used alongside scoping process metrics to key apps like Webex and Duo, and moving high-cardinality data to logs, to achieve an overall 75% reduction in endpoint telemetry. _Teams tuning OpenTelemetry collection intervals compare real-world tradeoffs like this on daily.dev._ ### What criteria should I use to decide which endpoint metrics are worth collecting in an observability platform? Evaluate each candidate metric against four filters: actionability (does it trigger a specific support response), utility (does it duplicate existing data or add unique context), efficiency (should it be a continuous metric or a log-based snapshot to avoid high cardinality), and scope (does the whole fleet need it or only specific cohorts). This turns metric collection into a deliberate investment decision rather than collecting everything by default. _Engineers designing telemetry budgets can track frameworks like this on daily.dev._ ## Similar posts on daily.dev - [Cisco IT’s observability transformation: From fragmented data to unified insights](https://daily.dev/posts/cisco-it-s-observability-transformation-from-fragmented-data-to-unified-insights-2jkzzptqk) · Cisco · 0 upvotes · 0 comments - [Telemetry that matters: Designing sustainable, high-impact observability pipelines](https://daily.dev/posts/telemetry-that-matters-designing-sustainable-high-impact-observability-pipelines-vnwf2uag2) · CNCF · 6 upvotes · 0 comments - [Observability 2.0: Why DevOps Teams Are Moving From Monitoring to Intelligent System Understanding](https://daily.dev/posts/observability-2-0-why-devops-teams-are-moving-from-monitoring-to-intelligent-system-understanding-uveczef2f) · DevOps.com · 9 upvotes · 1 comments - [Overcoming Cloud-Native Observability Challenges: Dealing With High Data Volume and Dynamic Environments](https://daily.dev/posts/overcoming-cloud-native-observability-challenges-dealing-with-high-data-volume-and-dynamic-environm-ntr8ufg3b) · Cloud Native Now · 0 upvotes · 0 comments - [An End-to-End Cloud Native Observability Framework](https://daily.dev/posts/an-end-to-end-cloud-native-observability-framework-4gzq4zqow) · The New Stack · 0 upvotes · 0 comments --- Tags: [#observability](https://daily.dev/tags/observability), [#logging](https://daily.dev/tags/logging), [#opentelemetry](https://daily.dev/tags/opentelemetry), [#it](https://daily.dev/tags/it) [View this post on daily.dev](https://daily.dev/posts/cisco-it-s-endpoint-observability-strategy-right-sized-telemetry-for-splunk-observability-cloud-ooczm2ilx) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Cisco IT’s Endpoint Observability Strategy: Right-Sized Telemetry for Splunk Observability Cloud","url":"https://daily.dev/posts/cisco-it-s-endpoint-observability-strategy-right-sized-telemetry-for-splunk-observability-cloud-ooczm2ilx","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/cisco-it-s-endpoint-observability-strategy-right-sized-telemetry-for-splunk-observability-cloud-ooczm2ilx"},"datePublished":"2026-10-28T17:01:24.417Z","dateModified":"2026-10-28T17:22:25.080Z","description":"Cisco IT cut endpoint telemetry volume by 75% by right-sizing what it collects through Splunk Observability Cloud. The team catalogued every metric from the...","image":"https://media.daily.dev/image/upload/s--P4t4XyoV--/f_auto/v1722860399/public/Placeholder%2001","thumbnailUrl":"https://media.daily.dev/image/upload/s--P4t4XyoV--/f_auto/v1722860399/public/Placeholder%2001","isAccessibleForFree":true,"articleSection":"Cisco","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Cisco","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/68b8a8be17184235a5067d7c84162f77","url":"https://daily.dev/sources/cisco"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/cisco-it-s-endpoint-observability-strategy-right-sized-telemetry-for-splunk-observability-cloud-ooczm2ilx","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"observability,logging,opentelemetry,it","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Cisco","item":"https://daily.dev/sources/cisco"},{"@type":"ListItem","position":3,"name":"Cisco IT’s Endpoint Observability Strategy: Right-Sized Telemetry for Splunk Observability Cloud"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/cisco-it-s-endpoint-observability-strategy-right-sized-telemetry-for-splunk-observability-cloud-ooczm2ilx#faq","mainEntity":[{"@type":"Question","name":"How much can increasing the Splunk OpenTelemetry Collector's metric interval from 10 seconds to 60 seconds reduce data volume?","acceptedAnswer":{"@type":"Answer","text":"Increasing the collection interval from the Collector's default 10 seconds to 60 seconds can cut datapoint volume by up to 75% in endpoint telemetry modeling. This was one of eight strategies Cisco IT used alongside scoping process metrics to key apps like Webex and Duo, and moving high-cardinality data to logs, to achieve an overall 75% reduction in endpoint telemetry. Teams tuning OpenTelemetry collection intervals compare real-world tradeoffs like this on daily.dev."}},{"@type":"Question","name":"What criteria should I use to decide which endpoint metrics are worth collecting in an observability platform?","acceptedAnswer":{"@type":"Answer","text":"Evaluate each candidate metric against four filters: actionability (does it trigger a specific support response), utility (does it duplicate existing data or add unique context), efficiency (should it be a continuous metric or a log-based snapshot to avoid high cardinality), and scope (does the whole fleet need it or only specific cohorts). This turns metric collection into a deliberate investment decision rather than collecting everything by default. Engineers designing telemetry budgets can track frameworks like this on daily.dev."}}]} ```