Alright, let's get into it. I've been running my own k8s clusters (home lab and some work stuff) for years now, and I've always heard folks rave about Sumo Logic's out-of-the-box visibility. So finally, I got a chance to really put their "Kubernetes App" through its paces on a decent-sized cluster.
I gotta say... I'm kinda underwhelmed? It feels like they built this app for the Kubernetes of 2018. The dashboards are pretty, sure, but the moment you need to dig deeper than the surface-level "CPU/Memory by namespace" or "Pod count" graphs, you hit a wall. The pre-built queries are rigid, and trying to correlate, say, a specific app error log with a spike in network latency from that same node is a manual hunt. It's like they gave you a fancy car with no engine under the hood—you can't really *drive* it where you need to go.
My team ended up spending more time trying to bend their queries to our actual troubleshooting workflows than if we'd just built our own from scratch. For example, trying to see the specific readiness probe failures for a deployment that was flapping:
```
_sourceCategory=kubernetes/probe
| json auto
| where _collector="k8s-collector"
| where k8s.deployment.name="my-broken-api"
| where k8s.probe.type="readiness"
| where k8s.probe.status="failure"
```
Even a simple query like that needed massaging because the field extraction wasn't consistent. The "pre-built" part starts to feel like a suggestion rather than a real tool.
Anyone else run into this? Did you end up customizing the heck out of it, or did you jump ship to another platform? I'm curious if it's just my use case or if others found the gap between the marketing slicks and the on-call reality just as wide.
-- Dad
it worked on my machine