Snowflake lifecycle events

Latest Dynatrace
Reference

Timestamp-based state-change events emitted by Dynatrace Snowflake Observability Agent plugins via the Dynatrace OpenPipeline Events API.

Query

Fetch the most recent Dynatrace Snowflake Observability Agent budgets lifecycle events from Grail.

fetch events
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "budgets"
| sort timestamp desc
| limit 50

Count Dynatrace Snowflake Observability Agent budgets lifecycle events grouped by event type.

fetch events
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "budgets"
| summarize { events = count() }, by: { snowflake.event.type }
| sort events desc

Fetch budget-creation lifecycle events reported by the budgets plugin.

fetch events
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "budgets"
| filter snowflake.event.type == "snowflake.budget.created_on"
| sort timestamp desc
| limit 25

Snowflake Resource Monitors lifecycle events

Timestamp-based state-change events emitted by the Dynatrace Snowflake Observability Agent resource_monitors plugin via the OpenPipeline Events API.

Query

Fetch the most recent Dynatrace Snowflake Observability Agent resource_monitors lifecycle events (monitor and warehouse state changes).

fetch events
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "resource_monitors"
| sort timestamp desc
| limit 50

Count Dynatrace Snowflake Observability Agent resource_monitors lifecycle events grouped by event type.

fetch events
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "resource_monitors"
| summarize { events = count() }, by: { snowflake.event.type }
| sort events desc

Inspect resource monitor lifecycle events with their monitor name and event type.

fetch events
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "resource_monitors"
| filter isNotNull(snowflake.resource_monitor.name)
| fields timestamp, snowflake.event.type, snowflake.resource_monitor.name
| sort timestamp desc
| limit 25

Dynatrace Snowflake Observability Agent resource fields

Fields present on all Dynatrace Snowflake Observability Agent telemetry records. Synced with config.py RESOURCE_ATTRIBUTES.

Attribute	Type	Description	Examples
`db.system`	string	experimental Display name: `Database system` An identifier for the database management system (DBMS) product being used. See below for a list of well-known identifiers. ¹	`mongodb`; `mysql`
`deployment.environment`	string	resource deprecated Use deployment.environment.name instead. Display name: `Snowflake deployment environment` Deprecated alias for deployment.environment.name. The deployment environment, for example, production, staging, or development. Will be removed in release 1.3.0. ²	`PROD`
`deployment.environment.name`	string	resource stable Display name: `Snowflake deployment environment name` The deployment environment name (OTel semconv canonical field), for example, production, staging, or development. Emitted alongside deployment.environment during the deprecation window. ³	`PROD`
`deployment.environment.tag`	string	resource stable Display name: `Deployment environment tag` Optional tag for the deployment environment in multitenancy mode ⁴	`SA080`
`dsoa.run.context`	string	resource stable Display name: `Dynatrace Snowflake Observability Agent execution context` The name of the Dynatrace Snowflake Observability Agent context (part of plugin) used to produce the telemetry (logs, traces, metrics, or events). In case of multiple contexts within the same plugin, this helps differentiate between them. If plugin delivers only one context, this field will have the same value as the plugin name. ⁵	`users_all_roles`
`dsoa.run.id`	string	resource stable Display name: `Dynatrace Snowflake Observability Agent execution unique identifier` Unique ID of each execution of the Dynatrace Snowflake Observability Agent plugin. It can be used to differentiate between telemetry produced between two executions, for example, to calculate the change in the system. ⁶	`4aa7c76c-e98c-4b8b-a5b3-a8a721bbde2d`
`dsoa.run.plugin`	string	resource stable Display name: `Dynatrace Snowflake Observability Agent execution plugin name` The name of the Dynatrace Snowflake Observability Agent plugin that produced this telemetry. Use to filter all telemetry from a specific plugin (for example, 'query_history', 'warehouse_usage'). Distinct from dsoa.run.context, which may represent a sub-context within a plugin. ⁷	`users`
`host.name`	string	resource experimental Display name: `Host name` The host name as determined on the data source (for instance, OneAgent, extensions or OpenTelemetry). Important: This is not the name of the host entity, which can be modified based on naming rules. ⁸ Tags: `permission`	`ip-10-178-54-32.ec2.internal`
`service.name`	string	resource stable Display name: `OTel service name` The logical name of the service. ⁹	`shoppingcart`
`telemetry.exporter.name`	string	resource experimental Display name: `Telemetry exporter name` The exporter name. ¹⁰	`odin`
`telemetry.exporter.version`	string	resource experimental Display name: `Telemetry exporter version` The full agent/exporter version. ¹¹	`1.285.1.20240101-256988`

Always 'snowflake' for all Dynatrace Snowflake Observability Agent telemetry.

User-configured deployment environment label, for example, 'PROD', 'STG', or 'DEV'. Set via 'core.snowflake.deployment_environment'.

User-configured deployment environment label (OTel-stable canonical key), for example, 'PROD', 'STG', or 'DEV'. Set via 'core.snowflake.deployment_environment'. Prefer this key over the deprecated deployment.environment alias.

⁴

Optional user-defined tag for grouping Snowflake accounts in multitenancy mode, set via 'core.tag'.

⁵

Identifies the specific sub-context within the plugin (for example, 'query_history', 'users_all_roles').

⁶

Unique identifier for a single Dynatrace Snowflake Observability Agent execution run. Changes on every invocation.

⁷

The Dynatrace Snowflake Observability Agent plugin that produced this telemetry (for example, 'query_history', 'warehouse_usage').

⁸

The Snowflake account hostname (for example, 'xy12345.snowflakecomputing.com'), from 'core.snowflake.host_name'.

⁹

Always the Snowflake account identifier without '.snowflakecomputing.com' suffix (for example, 'myorg-myaccount').

¹⁰

Always 'dynatrace.snowagent' — identifies Dynatrace Snowflake Observability Agent as the telemetry exporter.

¹¹

The installed Dynatrace Snowflake Observability Agent version in <major>.<minor>.<patch>.<build> format.

db.system has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`adabas`	Adabas (Adaptable Database System)	Adabas
`amazon-documentdb`	Amazon DocumentDB	DocumentDB
`aurora-mysql`	Amazon Aurora MySQL	Aurora MySQL
`aurora-postgresql`	Amazon Aurora PostgreSQL	Aurora PostgreSQL
`cache`	InterSystems Caché	InterSystems Caché
`cassandra`	Apache Cassandra	Cassandra
`clickhouse`	ClickHouse	ClickHouse
`cloudscape`	Cloudscape	Cloudscape
`cockroachdb`	CockroachDB	CockroachDB
`coldfusion`	ColdFusion IMQ	ColdFusion IMQ
`cosmosdb`	Microsoft Azure Cosmos DB	Cosmos DB
`couchbase`	Couchbase	Couchbase
`couchdb`	CouchDB	CouchDB
`databricks`	Databricks Data Platform	Databricks Data Platform
`db2`	IBM Db2	IBM Db2
`derby`	Apache Derby	Derby
`dl/i`	IBM DL/I	IBM DL/I
`dynamodb`	Amazon DynamoDB	DynamoDB
`edb`	EnterpriseDB	EnterpriseDB
`elasticsearch`	Elasticsearch	Elasticsearch
`filemaker`	FileMaker	FileMaker
`firebird`	Firebird	Firebird
`firstsql`	FirstSQL	FirstSQL
`geode`	Apache Geode	Geode
`h2`	H2	H2
`hanadb`	SAP HANA	SAP HANA
`hbase`	Apache HBase	HBase
`hive`	Apache Hive	Hive
`hsqldb`	HyperSQL DataBase	HSQLDB
`informix`	Informix	Informix
`ingres`	Ingres	Ingres
`instantdb`	InstantDB	InstantDB
`interbase`	InterBase	InterBase
`keyspaces-cassandra`	Amazon Keyspaces for Apache Cassandra	Keyspaces
`mariadb`	MariaDB	MariaDB
`maxdb`	SAP MaxDB	SAP MaxDB
`memcached`	Memcached	Memcached
`mongodb`	MongoDB	MongoDB
`mssql`	Microsoft SQL Server	SQL Server
`mssqlcompact`	Microsoft SQL Server Compact	SQL Server Compact
`mysql`	MySQL	MySQL
`neo4j`	Neo4j	Neo4j
`neptune`	Amazon Neptune	Neptune
`netezza`	Netezza	Netezza
`opensearch`	OpenSearch	OpenSearch
`oracle`	Oracle Database	Oracle
`other_sql`	Some other SQL database. Fallback only. See notes.	Other SQL
`pervasive`	Pervasive PSQL	Pervasive PSQL
`phoenix`	Apache Phoenix	Apache Phoenix
`pointbase`	PointBase	PointBase
`postgresql`	PostgreSQL	PostgreSQL
`progress`	Progress Database	Progress
`redis`	Redis	Redis
`redshift`	Amazon Redshift	Redshift
`snowflake`	Snowflake Data Platform	Snowflake Data Platform
`spanner`	Cloud Spanner	Cloud Spanner
`sqlite`	SQLite	SQLite
`sybase`	Sybase	Sybase
`teradata`	Teradata	Teradata
`valkey`	Valkey	Valkey
`vertica`	Vertica	Vertica

Resource Monitors event fields

Attribute	Type	Description	Examples
`snowflake.event.type`	string	experimental Display name: `Snowflake event type` Type of (timestamp based) event	`snowflake.table.update`
`snowflake.resource_monitor.created_on`	long	experimental Display name: `Snowflake resource monitor creation time` The timestamp when the resource monitor was created.	`1728991696789000000`
`snowflake.resource_monitor.end_time`	long	experimental Display name: `Snowflake resource monitor end time` The timestamp when the resource monitor ended.	`1732981199999000000`
`snowflake.resource_monitor.start_time`	long	experimental Display name: `Snowflake resource monitor start time` The timestamp when the resource monitor started.	`1730419200000000000`
`snowflake.warehouse.created_on`	string	experimental Display name: `Snowflake warehouse creation time` The timestamp when the warehouse was created. ¹	`2024-09-01 08:00:00.000`
`snowflake.warehouse.resumed_on`	string	stable Display name: `Snowflake warehouse last resumed time` The timestamp when the warehouse was last resumed. ²	`2024-11-15 09:00:00.000`
`snowflake.warehouse.updated_on`	string	experimental Display name: `Snowflake warehouse last updated time` The timestamp when the warehouse was last updated. ²	`2024-11-10 14:30:00.000`

ISO 8601 timestamp string stored as string in Grail. Grail stores this as a plain string; use toTimestamp() in DQL for time-based operations.

ISO 8601 timestamp string stored as string in Grail.

Snowflake Snowpipes lifecycle events

Timestamp-based state-change events emitted by the Dynatrace Snowflake Observability Agent snowpipes plugin via the OpenPipeline Events API.

Query

Fetch recent Dynatrace Snowflake Observability Agent snowpipes lifecycle events.

fetch events
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "snowpipes"
| sort timestamp desc
| limit 20

Fetch the most recent Dynatrace Snowflake Observability Agent snowpipes lifecycle events (pipe creation anchors).

fetch events
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "snowpipes"
| sort timestamp desc
| limit 50

Count Dynatrace Snowflake Observability Agent snowpipes lifecycle events grouped by event type.

fetch events
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "snowpipes"
| summarize { events = count() }, by: { snowflake.event.type }
| sort events desc

Dynatrace Snowflake Observability Agent resource fields

Fields present on all Dynatrace Snowflake Observability Agent telemetry records. Synced with config.py RESOURCE_ATTRIBUTES.

Attribute	Type	Description	Examples
`db.system`	string	experimental Display name: `Database system` An identifier for the database management system (DBMS) product being used. See below for a list of well-known identifiers. ¹	`mongodb`; `mysql`
`deployment.environment`	string	resource deprecated Use deployment.environment.name instead. Display name: `Snowflake deployment environment` Deprecated alias for deployment.environment.name. The deployment environment, for example, production, staging, or development. Will be removed in release 1.3.0. ²	`PROD`
`deployment.environment.name`	string	resource stable Display name: `Snowflake deployment environment name` The deployment environment name (OTel semconv canonical field), for example, production, staging, or development. Emitted alongside deployment.environment during the deprecation window. ³	`PROD`
`deployment.environment.tag`	string	resource stable Display name: `Deployment environment tag` Optional tag for the deployment environment in multitenancy mode ⁴	`SA080`
`dsoa.run.context`	string	resource stable Display name: `Dynatrace Snowflake Observability Agent execution context` The name of the Dynatrace Snowflake Observability Agent context (part of plugin) used to produce the telemetry (logs, traces, metrics, or events). In case of multiple contexts within the same plugin, this helps differentiate between them. If plugin delivers only one context, this field will have the same value as the plugin name. ⁵	`users_all_roles`
`dsoa.run.id`	string	resource stable Display name: `Dynatrace Snowflake Observability Agent execution unique identifier` Unique ID of each execution of the Dynatrace Snowflake Observability Agent plugin. It can be used to differentiate between telemetry produced between two executions, for example, to calculate the change in the system. ⁶	`4aa7c76c-e98c-4b8b-a5b3-a8a721bbde2d`
`dsoa.run.plugin`	string	resource stable Display name: `Dynatrace Snowflake Observability Agent execution plugin name` The name of the Dynatrace Snowflake Observability Agent plugin that produced this telemetry. Use to filter all telemetry from a specific plugin (for example, 'query_history', 'warehouse_usage'). Distinct from dsoa.run.context, which may represent a sub-context within a plugin. ⁷	`users`
`host.name`	string	resource experimental Display name: `Host name` The host name as determined on the data source (for instance, OneAgent, extensions or OpenTelemetry). Important: This is not the name of the host entity, which can be modified based on naming rules. ⁸ Tags: `permission`	`ip-10-178-54-32.ec2.internal`
`service.name`	string	resource stable Display name: `OTel service name` The logical name of the service. ⁹	`shoppingcart`
`telemetry.exporter.name`	string	resource experimental Display name: `Telemetry exporter name` The exporter name. ¹⁰	`odin`
`telemetry.exporter.version`	string	resource experimental Display name: `Telemetry exporter version` The full agent/exporter version. ¹¹	`1.285.1.20240101-256988`

Always 'snowflake' for all Dynatrace Snowflake Observability Agent telemetry.

User-configured deployment environment label, for example, 'PROD', 'STG', or 'DEV'. Set via 'core.snowflake.deployment_environment'.

⁴

Optional user-defined tag for grouping Snowflake accounts in multitenancy mode, set via 'core.tag'.

⁵

Identifies the specific sub-context within the plugin (for example, 'query_history', 'users_all_roles').

⁶

Unique identifier for a single Dynatrace Snowflake Observability Agent execution run. Changes on every invocation.

⁷

The Dynatrace Snowflake Observability Agent plugin that produced this telemetry (for example, 'query_history', 'warehouse_usage').

⁸

The Snowflake account hostname (for example, 'xy12345.snowflakecomputing.com'), from 'core.snowflake.host_name'.

⁹

Always the Snowflake account identifier without '.snowflakecomputing.com' suffix (for example, 'myorg-myaccount').

¹⁰

Always 'dynatrace.snowagent' — identifies Dynatrace Snowflake Observability Agent as the telemetry exporter.

¹¹

The installed Dynatrace Snowflake Observability Agent version in <major>.<minor>.<patch>.<build> format.

db.system has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`adabas`	Adabas (Adaptable Database System)	Adabas
`amazon-documentdb`	Amazon DocumentDB	DocumentDB
`aurora-mysql`	Amazon Aurora MySQL	Aurora MySQL
`aurora-postgresql`	Amazon Aurora PostgreSQL	Aurora PostgreSQL
`cache`	InterSystems Caché	InterSystems Caché
`cassandra`	Apache Cassandra	Cassandra
`clickhouse`	ClickHouse	ClickHouse
`cloudscape`	Cloudscape	Cloudscape
`cockroachdb`	CockroachDB	CockroachDB
`coldfusion`	ColdFusion IMQ	ColdFusion IMQ
`cosmosdb`	Microsoft Azure Cosmos DB	Cosmos DB
`couchbase`	Couchbase	Couchbase
`couchdb`	CouchDB	CouchDB
`databricks`	Databricks Data Platform	Databricks Data Platform
`db2`	IBM Db2	IBM Db2
`derby`	Apache Derby	Derby
`dl/i`	IBM DL/I	IBM DL/I
`dynamodb`	Amazon DynamoDB	DynamoDB
`edb`	EnterpriseDB	EnterpriseDB
`elasticsearch`	Elasticsearch	Elasticsearch
`filemaker`	FileMaker	FileMaker
`firebird`	Firebird	Firebird
`firstsql`	FirstSQL	FirstSQL
`geode`	Apache Geode	Geode
`h2`	H2	H2
`hanadb`	SAP HANA	SAP HANA
`hbase`	Apache HBase	HBase
`hive`	Apache Hive	Hive
`hsqldb`	HyperSQL DataBase	HSQLDB
`informix`	Informix	Informix
`ingres`	Ingres	Ingres
`instantdb`	InstantDB	InstantDB
`interbase`	InterBase	InterBase
`keyspaces-cassandra`	Amazon Keyspaces for Apache Cassandra	Keyspaces
`mariadb`	MariaDB	MariaDB
`maxdb`	SAP MaxDB	SAP MaxDB
`memcached`	Memcached	Memcached
`mongodb`	MongoDB	MongoDB
`mssql`	Microsoft SQL Server	SQL Server
`mssqlcompact`	Microsoft SQL Server Compact	SQL Server Compact
`mysql`	MySQL	MySQL
`neo4j`	Neo4j	Neo4j
`neptune`	Amazon Neptune	Neptune
`netezza`	Netezza	Netezza
`opensearch`	OpenSearch	OpenSearch
`oracle`	Oracle Database	Oracle
`other_sql`	Some other SQL database. Fallback only. See notes.	Other SQL
`pervasive`	Pervasive PSQL	Pervasive PSQL
`phoenix`	Apache Phoenix	Apache Phoenix
`pointbase`	PointBase	PointBase
`postgresql`	PostgreSQL	PostgreSQL
`progress`	Progress Database	Progress
`redis`	Redis	Redis
`redshift`	Amazon Redshift	Redshift
`snowflake`	Snowflake Data Platform	Snowflake Data Platform
`spanner`	Cloud Spanner	Cloud Spanner
`sqlite`	SQLite	SQLite
`sybase`	Sybase	Sybase
`teradata`	Teradata	Teradata
`valkey`	Valkey	Valkey
`vertica`	Vertica	Vertica

Snowpipes event fields

Attribute	Type	Description	Examples
`snowflake.event.type`	string	experimental Display name: `Snowflake event type` Type of (timestamp based) event	`snowflake.table.update`
`snowflake.pipe.created_on`	long	stable Display name: `Snowflake pipe creation time` Pipe creation event.	`1736936200000000000`

Snowflake budgets lifecycle events

Timestamp-based state-change events emitted by the Dynatrace Snowflake Observability Agent budgets plugin via the OpenPipeline Events API.

Query

Fetch the most recent Dynatrace Snowflake Observability Agent budgets lifecycle events from Grail.

fetch events
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "budgets"
| sort timestamp desc
| limit 50

Count Dynatrace Snowflake Observability Agent budgets lifecycle events grouped by event type.

fetch events
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "budgets"
| summarize { events = count() }, by: { snowflake.event.type }
| sort events desc

Fetch budget-creation lifecycle events reported by the budgets plugin.

fetch events
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "budgets"
| filter snowflake.event.type == "snowflake.budget.created_on"
| sort timestamp desc
| limit 25

Dynatrace Snowflake Observability Agent resource fields

Fields present on all Dynatrace Snowflake Observability Agent telemetry records. Synced with config.py RESOURCE_ATTRIBUTES.

Attribute	Type	Description	Examples
`db.system`	string	experimental Display name: `Database system` An identifier for the database management system (DBMS) product being used. See below for a list of well-known identifiers. ¹	`mongodb`; `mysql`
`deployment.environment`	string	resource deprecated Use deployment.environment.name instead. Display name: `Snowflake deployment environment` Deprecated alias for deployment.environment.name. The deployment environment, for example, production, staging, or development. Will be removed in release 1.3.0. ²	`PROD`
`deployment.environment.name`	string	resource stable Display name: `Snowflake deployment environment name` The deployment environment name (OTel semconv canonical field), for example, production, staging, or development. Emitted alongside deployment.environment during the deprecation window. ³	`PROD`
`deployment.environment.tag`	string	resource stable Display name: `Deployment environment tag` Optional tag for the deployment environment in multitenancy mode ⁴	`SA080`
`dsoa.run.context`	string	resource stable Display name: `Dynatrace Snowflake Observability Agent execution context` The name of the Dynatrace Snowflake Observability Agent context (part of plugin) used to produce the telemetry (logs, traces, metrics, or events). In case of multiple contexts within the same plugin, this helps differentiate between them. If plugin delivers only one context, this field will have the same value as the plugin name. ⁵	`users_all_roles`
`dsoa.run.id`	string	resource stable Display name: `Dynatrace Snowflake Observability Agent execution unique identifier` Unique ID of each execution of the Dynatrace Snowflake Observability Agent plugin. It can be used to differentiate between telemetry produced between two executions, for example, to calculate the change in the system. ⁶	`4aa7c76c-e98c-4b8b-a5b3-a8a721bbde2d`
`dsoa.run.plugin`	string	resource stable Display name: `Dynatrace Snowflake Observability Agent execution plugin name` The name of the Dynatrace Snowflake Observability Agent plugin that produced this telemetry. Use to filter all telemetry from a specific plugin (for example, 'query_history', 'warehouse_usage'). Distinct from dsoa.run.context, which may represent a sub-context within a plugin. ⁷	`users`
`host.name`	string	resource experimental Display name: `Host name` The host name as determined on the data source (for instance, OneAgent, extensions or OpenTelemetry). Important: This is not the name of the host entity, which can be modified based on naming rules. ⁸ Tags: `permission`	`ip-10-178-54-32.ec2.internal`
`service.name`	string	resource stable Display name: `OTel service name` The logical name of the service. ⁹	`shoppingcart`
`telemetry.exporter.name`	string	resource experimental Display name: `Telemetry exporter name` The exporter name. ¹⁰	`odin`
`telemetry.exporter.version`	string	resource experimental Display name: `Telemetry exporter version` The full agent/exporter version. ¹¹	`1.285.1.20240101-256988`

Always 'snowflake' for all Dynatrace Snowflake Observability Agent telemetry.

User-configured deployment environment label, for example, 'PROD', 'STG', or 'DEV'. Set via 'core.snowflake.deployment_environment'.

⁴

Optional user-defined tag for grouping Snowflake accounts in multitenancy mode, set via 'core.tag'.

⁵

Identifies the specific sub-context within the plugin (for example, 'query_history', 'users_all_roles').

⁶

Unique identifier for a single Dynatrace Snowflake Observability Agent execution run. Changes on every invocation.

⁷

The Dynatrace Snowflake Observability Agent plugin that produced this telemetry (for example, 'query_history', 'warehouse_usage').

⁸

The Snowflake account hostname (for example, 'xy12345.snowflakecomputing.com'), from 'core.snowflake.host_name'.

⁹

Always the Snowflake account identifier without '.snowflakecomputing.com' suffix (for example, 'myorg-myaccount').

¹⁰

Always 'dynatrace.snowagent' — identifies Dynatrace Snowflake Observability Agent as the telemetry exporter.

¹¹

The installed Dynatrace Snowflake Observability Agent version in <major>.<minor>.<patch>.<build> format.

db.system has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`adabas`	Adabas (Adaptable Database System)	Adabas
`amazon-documentdb`	Amazon DocumentDB	DocumentDB
`aurora-mysql`	Amazon Aurora MySQL	Aurora MySQL
`aurora-postgresql`	Amazon Aurora PostgreSQL	Aurora PostgreSQL
`cache`	InterSystems Caché	InterSystems Caché
`cassandra`	Apache Cassandra	Cassandra
`clickhouse`	ClickHouse	ClickHouse
`cloudscape`	Cloudscape	Cloudscape
`cockroachdb`	CockroachDB	CockroachDB
`coldfusion`	ColdFusion IMQ	ColdFusion IMQ
`cosmosdb`	Microsoft Azure Cosmos DB	Cosmos DB
`couchbase`	Couchbase	Couchbase
`couchdb`	CouchDB	CouchDB
`databricks`	Databricks Data Platform	Databricks Data Platform
`db2`	IBM Db2	IBM Db2
`derby`	Apache Derby	Derby
`dl/i`	IBM DL/I	IBM DL/I
`dynamodb`	Amazon DynamoDB	DynamoDB
`edb`	EnterpriseDB	EnterpriseDB
`elasticsearch`	Elasticsearch	Elasticsearch
`filemaker`	FileMaker	FileMaker
`firebird`	Firebird	Firebird
`firstsql`	FirstSQL	FirstSQL
`geode`	Apache Geode	Geode
`h2`	H2	H2
`hanadb`	SAP HANA	SAP HANA
`hbase`	Apache HBase	HBase
`hive`	Apache Hive	Hive
`hsqldb`	HyperSQL DataBase	HSQLDB
`informix`	Informix	Informix
`ingres`	Ingres	Ingres
`instantdb`	InstantDB	InstantDB
`interbase`	InterBase	InterBase
`keyspaces-cassandra`	Amazon Keyspaces for Apache Cassandra	Keyspaces
`mariadb`	MariaDB	MariaDB
`maxdb`	SAP MaxDB	SAP MaxDB
`memcached`	Memcached	Memcached
`mongodb`	MongoDB	MongoDB
`mssql`	Microsoft SQL Server	SQL Server
`mssqlcompact`	Microsoft SQL Server Compact	SQL Server Compact
`mysql`	MySQL	MySQL
`neo4j`	Neo4j	Neo4j
`neptune`	Amazon Neptune	Neptune
`netezza`	Netezza	Netezza
`opensearch`	OpenSearch	OpenSearch
`oracle`	Oracle Database	Oracle
`other_sql`	Some other SQL database. Fallback only. See notes.	Other SQL
`pervasive`	Pervasive PSQL	Pervasive PSQL
`phoenix`	Apache Phoenix	Apache Phoenix
`pointbase`	PointBase	PointBase
`postgresql`	PostgreSQL	PostgreSQL
`progress`	Progress Database	Progress
`redis`	Redis	Redis
`redshift`	Amazon Redshift	Redshift
`snowflake`	Snowflake Data Platform	Snowflake Data Platform
`spanner`	Cloud Spanner	Cloud Spanner
`sqlite`	SQLite	SQLite
`sybase`	Sybase	Sybase
`teradata`	Teradata	Teradata
`valkey`	Valkey	Valkey
`vertica`	Vertica	Vertica

Budgets event fields

Attribute	Type	Description	Examples
`snowflake.budget.created_on`	long	stable Display name: `Snowflake budget creation time` The timestamp when the budget was created.	`1732981199999000000`
`snowflake.event.type`	string	experimental Display name: `Snowflake event type` Type of (timestamp based) event	`snowflake.table.update`

Snowflake data volume lifecycle events

Timestamp-based state-change events emitted by the Dynatrace Snowflake Observability Agent data_volume plugin via the OpenPipeline Events API.

Query

Fetch recent Dynatrace Snowflake Observability Agent data_volume lifecycle events.

fetch events
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "data_volume"
| sort timestamp desc
| limit 20

Fetch the most recent Dynatrace Snowflake Observability Agent data_volume lifecycle events (table DDL and data-update anchors).

fetch events
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "data_volume"
| sort timestamp desc
| limit 50

Count Dynatrace Snowflake Observability Agent data_volume lifecycle events grouped by event type.

fetch events
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "data_volume"
| summarize { events = count() }, by: { snowflake.event.type }
| sort events desc

Dynatrace Snowflake Observability Agent resource fields

Fields present on all Dynatrace Snowflake Observability Agent telemetry records. Synced with config.py RESOURCE_ATTRIBUTES.

Attribute	Type	Description	Examples
`db.system`	string	experimental Display name: `Database system` An identifier for the database management system (DBMS) product being used. See below for a list of well-known identifiers. ¹	`mongodb`; `mysql`
`deployment.environment`	string	resource deprecated Use deployment.environment.name instead. Display name: `Snowflake deployment environment` Deprecated alias for deployment.environment.name. The deployment environment, for example, production, staging, or development. Will be removed in release 1.3.0. ²	`PROD`
`deployment.environment.name`	string	resource stable Display name: `Snowflake deployment environment name` The deployment environment name (OTel semconv canonical field), for example, production, staging, or development. Emitted alongside deployment.environment during the deprecation window. ³	`PROD`
`deployment.environment.tag`	string	resource stable Display name: `Deployment environment tag` Optional tag for the deployment environment in multitenancy mode ⁴	`SA080`
`dsoa.run.context`	string	resource stable Display name: `Dynatrace Snowflake Observability Agent execution context` The name of the Dynatrace Snowflake Observability Agent context (part of plugin) used to produce the telemetry (logs, traces, metrics, or events). In case of multiple contexts within the same plugin, this helps differentiate between them. If plugin delivers only one context, this field will have the same value as the plugin name. ⁵	`users_all_roles`
`dsoa.run.id`	string	resource stable Display name: `Dynatrace Snowflake Observability Agent execution unique identifier` Unique ID of each execution of the Dynatrace Snowflake Observability Agent plugin. It can be used to differentiate between telemetry produced between two executions, for example, to calculate the change in the system. ⁶	`4aa7c76c-e98c-4b8b-a5b3-a8a721bbde2d`
`dsoa.run.plugin`	string	resource stable Display name: `Dynatrace Snowflake Observability Agent execution plugin name` The name of the Dynatrace Snowflake Observability Agent plugin that produced this telemetry. Use to filter all telemetry from a specific plugin (for example, 'query_history', 'warehouse_usage'). Distinct from dsoa.run.context, which may represent a sub-context within a plugin. ⁷	`users`
`host.name`	string	resource experimental Display name: `Host name` The host name as determined on the data source (for instance, OneAgent, extensions or OpenTelemetry). Important: This is not the name of the host entity, which can be modified based on naming rules. ⁸ Tags: `permission`	`ip-10-178-54-32.ec2.internal`
`service.name`	string	resource stable Display name: `OTel service name` The logical name of the service. ⁹	`shoppingcart`
`telemetry.exporter.name`	string	resource experimental Display name: `Telemetry exporter name` The exporter name. ¹⁰	`odin`
`telemetry.exporter.version`	string	resource experimental Display name: `Telemetry exporter version` The full agent/exporter version. ¹¹	`1.285.1.20240101-256988`

Always 'snowflake' for all Dynatrace Snowflake Observability Agent telemetry.

User-configured deployment environment label, for example, 'PROD', 'STG', or 'DEV'. Set via 'core.snowflake.deployment_environment'.

⁴

Optional user-defined tag for grouping Snowflake accounts in multitenancy mode, set via 'core.tag'.

⁵

Identifies the specific sub-context within the plugin (for example, 'query_history', 'users_all_roles').

⁶

Unique identifier for a single Dynatrace Snowflake Observability Agent execution run. Changes on every invocation.

⁷

The Dynatrace Snowflake Observability Agent plugin that produced this telemetry (for example, 'query_history', 'warehouse_usage').

⁸

The Snowflake account hostname (for example, 'xy12345.snowflakecomputing.com'), from 'core.snowflake.host_name'.

⁹

Always the Snowflake account identifier without '.snowflakecomputing.com' suffix (for example, 'myorg-myaccount').

¹⁰

Always 'dynatrace.snowagent' — identifies Dynatrace Snowflake Observability Agent as the telemetry exporter.

¹¹

The installed Dynatrace Snowflake Observability Agent version in <major>.<minor>.<patch>.<build> format.

db.system has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`adabas`	Adabas (Adaptable Database System)	Adabas
`amazon-documentdb`	Amazon DocumentDB	DocumentDB
`aurora-mysql`	Amazon Aurora MySQL	Aurora MySQL
`aurora-postgresql`	Amazon Aurora PostgreSQL	Aurora PostgreSQL
`cache`	InterSystems Caché	InterSystems Caché
`cassandra`	Apache Cassandra	Cassandra
`clickhouse`	ClickHouse	ClickHouse
`cloudscape`	Cloudscape	Cloudscape
`cockroachdb`	CockroachDB	CockroachDB
`coldfusion`	ColdFusion IMQ	ColdFusion IMQ
`cosmosdb`	Microsoft Azure Cosmos DB	Cosmos DB
`couchbase`	Couchbase	Couchbase
`couchdb`	CouchDB	CouchDB
`databricks`	Databricks Data Platform	Databricks Data Platform
`db2`	IBM Db2	IBM Db2
`derby`	Apache Derby	Derby
`dl/i`	IBM DL/I	IBM DL/I
`dynamodb`	Amazon DynamoDB	DynamoDB
`edb`	EnterpriseDB	EnterpriseDB
`elasticsearch`	Elasticsearch	Elasticsearch
`filemaker`	FileMaker	FileMaker
`firebird`	Firebird	Firebird
`firstsql`	FirstSQL	FirstSQL
`geode`	Apache Geode	Geode
`h2`	H2	H2
`hanadb`	SAP HANA	SAP HANA
`hbase`	Apache HBase	HBase
`hive`	Apache Hive	Hive
`hsqldb`	HyperSQL DataBase	HSQLDB
`informix`	Informix	Informix
`ingres`	Ingres	Ingres
`instantdb`	InstantDB	InstantDB
`interbase`	InterBase	InterBase
`keyspaces-cassandra`	Amazon Keyspaces for Apache Cassandra	Keyspaces
`mariadb`	MariaDB	MariaDB
`maxdb`	SAP MaxDB	SAP MaxDB
`memcached`	Memcached	Memcached
`mongodb`	MongoDB	MongoDB
`mssql`	Microsoft SQL Server	SQL Server
`mssqlcompact`	Microsoft SQL Server Compact	SQL Server Compact
`mysql`	MySQL	MySQL
`neo4j`	Neo4j	Neo4j
`neptune`	Amazon Neptune	Neptune
`netezza`	Netezza	Netezza
`opensearch`	OpenSearch	OpenSearch
`oracle`	Oracle Database	Oracle
`other_sql`	Some other SQL database. Fallback only. See notes.	Other SQL
`pervasive`	Pervasive PSQL	Pervasive PSQL
`phoenix`	Apache Phoenix	Apache Phoenix
`pointbase`	PointBase	PointBase
`postgresql`	PostgreSQL	PostgreSQL
`progress`	Progress Database	Progress
`redis`	Redis	Redis
`redshift`	Amazon Redshift	Redshift
`snowflake`	Snowflake Data Platform	Snowflake Data Platform
`spanner`	Cloud Spanner	Cloud Spanner
`sqlite`	SQLite	SQLite
`sybase`	Sybase	Sybase
`teradata`	Teradata	Teradata
`valkey`	Valkey	Valkey
`vertica`	Vertica	Vertica

Data volume event fields

Attribute	Type	Description	Examples
`snowflake.event.type`	string	experimental Display name: `Snowflake event type` Type of (timestamp based) event	`snowflake.table.update`
`snowflake.table.ddl`	long	experimental Display name: `Snowflake table last DDL time` The timestamp of the last DDL operation performed on the table or view, including CREATE, ALTER, DROP, or UNDROP.	`1730458800000000000`
`snowflake.table.update`	long	stable Display name: `Snowflake table last update time` The timestamp of the last time the object was altered by a DML, DDL, or background metadata operation.	`1731256700000000000`

Snowflake dynamic tables lifecycle events

Timestamp-based state-change events emitted by the Dynatrace Snowflake Observability Agent dynamic_tables plugin via the OpenPipeline Events API.

Query

Fetch the most recent Dynatrace Snowflake Observability Agent dynamic_tables lifecycle events (scheduling suspend/resume, graph version).

fetch events
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "dynamic_tables"
| sort timestamp desc
| limit 50

Count Dynatrace Snowflake Observability Agent dynamic_tables lifecycle events grouped by event type.

fetch events
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "dynamic_tables"
| summarize { events = count() }, by: { snowflake.event.type }
| sort events desc

Fetch scheduling-suspended lifecycle events for Snowflake dynamic tables.

fetch events
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "dynamic_tables"
| filter snowflake.event.type == "snowflake.table.dynamic.scheduling.suspended_on"
| sort timestamp desc
| limit 25

Dynatrace Snowflake Observability Agent resource fields

Fields present on all Dynatrace Snowflake Observability Agent telemetry records. Synced with config.py RESOURCE_ATTRIBUTES.

Attribute	Type	Description	Examples
`db.system`	string	experimental Display name: `Database system` An identifier for the database management system (DBMS) product being used. See below for a list of well-known identifiers. ¹	`mongodb`; `mysql`
`deployment.environment`	string	resource deprecated Use deployment.environment.name instead. Display name: `Snowflake deployment environment` Deprecated alias for deployment.environment.name. The deployment environment, for example, production, staging, or development. Will be removed in release 1.3.0. ²	`PROD`
`deployment.environment.name`	string	resource stable Display name: `Snowflake deployment environment name` The deployment environment name (OTel semconv canonical field), for example, production, staging, or development. Emitted alongside deployment.environment during the deprecation window. ³	`PROD`
`deployment.environment.tag`	string	resource stable Display name: `Deployment environment tag` Optional tag for the deployment environment in multitenancy mode ⁴	`SA080`
`dsoa.run.context`	string	resource stable Display name: `Dynatrace Snowflake Observability Agent execution context` The name of the Dynatrace Snowflake Observability Agent context (part of plugin) used to produce the telemetry (logs, traces, metrics, or events). In case of multiple contexts within the same plugin, this helps differentiate between them. If plugin delivers only one context, this field will have the same value as the plugin name. ⁵	`users_all_roles`
`dsoa.run.id`	string	resource stable Display name: `Dynatrace Snowflake Observability Agent execution unique identifier` Unique ID of each execution of the Dynatrace Snowflake Observability Agent plugin. It can be used to differentiate between telemetry produced between two executions, for example, to calculate the change in the system. ⁶	`4aa7c76c-e98c-4b8b-a5b3-a8a721bbde2d`
`dsoa.run.plugin`	string	resource stable Display name: `Dynatrace Snowflake Observability Agent execution plugin name` The name of the Dynatrace Snowflake Observability Agent plugin that produced this telemetry. Use to filter all telemetry from a specific plugin (for example, 'query_history', 'warehouse_usage'). Distinct from dsoa.run.context, which may represent a sub-context within a plugin. ⁷	`users`
`host.name`	string	resource experimental Display name: `Host name` The host name as determined on the data source (for instance, OneAgent, extensions or OpenTelemetry). Important: This is not the name of the host entity, which can be modified based on naming rules. ⁸ Tags: `permission`	`ip-10-178-54-32.ec2.internal`
`service.name`	string	resource stable Display name: `OTel service name` The logical name of the service. ⁹	`shoppingcart`
`telemetry.exporter.name`	string	resource experimental Display name: `Telemetry exporter name` The exporter name. ¹⁰	`odin`
`telemetry.exporter.version`	string	resource experimental Display name: `Telemetry exporter version` The full agent/exporter version. ¹¹	`1.285.1.20240101-256988`

Always 'snowflake' for all Dynatrace Snowflake Observability Agent telemetry.

User-configured deployment environment label, for example, 'PROD', 'STG', or 'DEV'. Set via 'core.snowflake.deployment_environment'.

⁴

Optional user-defined tag for grouping Snowflake accounts in multitenancy mode, set via 'core.tag'.

⁵

Identifies the specific sub-context within the plugin (for example, 'query_history', 'users_all_roles').

⁶

Unique identifier for a single Dynatrace Snowflake Observability Agent execution run. Changes on every invocation.

⁷

The Dynatrace Snowflake Observability Agent plugin that produced this telemetry (for example, 'query_history', 'warehouse_usage').

⁸

The Snowflake account hostname (for example, 'xy12345.snowflakecomputing.com'), from 'core.snowflake.host_name'.

⁹

Always the Snowflake account identifier without '.snowflakecomputing.com' suffix (for example, 'myorg-myaccount').

¹⁰

Always 'dynatrace.snowagent' — identifies Dynatrace Snowflake Observability Agent as the telemetry exporter.

¹¹

The installed Dynatrace Snowflake Observability Agent version in <major>.<minor>.<patch>.<build> format.

db.system has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`adabas`	Adabas (Adaptable Database System)	Adabas
`amazon-documentdb`	Amazon DocumentDB	DocumentDB
`aurora-mysql`	Amazon Aurora MySQL	Aurora MySQL
`aurora-postgresql`	Amazon Aurora PostgreSQL	Aurora PostgreSQL
`cache`	InterSystems Caché	InterSystems Caché
`cassandra`	Apache Cassandra	Cassandra
`clickhouse`	ClickHouse	ClickHouse
`cloudscape`	Cloudscape	Cloudscape
`cockroachdb`	CockroachDB	CockroachDB
`coldfusion`	ColdFusion IMQ	ColdFusion IMQ
`cosmosdb`	Microsoft Azure Cosmos DB	Cosmos DB
`couchbase`	Couchbase	Couchbase
`couchdb`	CouchDB	CouchDB
`databricks`	Databricks Data Platform	Databricks Data Platform
`db2`	IBM Db2	IBM Db2
`derby`	Apache Derby	Derby
`dl/i`	IBM DL/I	IBM DL/I
`dynamodb`	Amazon DynamoDB	DynamoDB
`edb`	EnterpriseDB	EnterpriseDB
`elasticsearch`	Elasticsearch	Elasticsearch
`filemaker`	FileMaker	FileMaker
`firebird`	Firebird	Firebird
`firstsql`	FirstSQL	FirstSQL
`geode`	Apache Geode	Geode
`h2`	H2	H2
`hanadb`	SAP HANA	SAP HANA
`hbase`	Apache HBase	HBase
`hive`	Apache Hive	Hive
`hsqldb`	HyperSQL DataBase	HSQLDB
`informix`	Informix	Informix
`ingres`	Ingres	Ingres
`instantdb`	InstantDB	InstantDB
`interbase`	InterBase	InterBase
`keyspaces-cassandra`	Amazon Keyspaces for Apache Cassandra	Keyspaces
`mariadb`	MariaDB	MariaDB
`maxdb`	SAP MaxDB	SAP MaxDB
`memcached`	Memcached	Memcached
`mongodb`	MongoDB	MongoDB
`mssql`	Microsoft SQL Server	SQL Server
`mssqlcompact`	Microsoft SQL Server Compact	SQL Server Compact
`mysql`	MySQL	MySQL
`neo4j`	Neo4j	Neo4j
`neptune`	Amazon Neptune	Neptune
`netezza`	Netezza	Netezza
`opensearch`	OpenSearch	OpenSearch
`oracle`	Oracle Database	Oracle
`other_sql`	Some other SQL database. Fallback only. See notes.	Other SQL
`pervasive`	Pervasive PSQL	Pervasive PSQL
`phoenix`	Apache Phoenix	Apache Phoenix
`pointbase`	PointBase	PointBase
`postgresql`	PostgreSQL	PostgreSQL
`progress`	Progress Database	Progress
`redis`	Redis	Redis
`redshift`	Amazon Redshift	Redshift
`snowflake`	Snowflake Data Platform	Snowflake Data Platform
`spanner`	Cloud Spanner	Cloud Spanner
`sqlite`	SQLite	SQLite
`sybase`	Sybase	Sybase
`teradata`	Teradata	Teradata
`valkey`	Valkey	Valkey
`vertica`	Vertica	Vertica

Dynamic tables event fields

Attribute	Type	Description	Examples
`snowflake.event.type`	string	experimental Display name: `Snowflake event type` Type of (timestamp based) event	`snowflake.table.update`
`snowflake.table.dynamic.graph.valid_from`	long	experimental Display name: `Snowflake dynamic table graph validity start time` The timestamp after which the description of the dynamic table is valid.	`1732135627448000000`
`snowflake.table.dynamic.scheduling.resumed_on`	string	stable Display name: `Snowflake dynamic table scheduling resume time` The timestamp when the dynamic table was last resumed, if ACTIVE. ¹	`2024-11-25 08:09:53.695 Z`
`snowflake.table.dynamic.scheduling.suspended_on`	string	experimental Display name: `Snowflake dynamic table scheduling suspend time` The timestamp when the dynamic table was suspended. ¹	`2024-11-25 06:09:53.695 Z`

ISO 8601 timestamp string stored as string in Grail.

Snowflake shares lifecycle events

Timestamp-based state-change events emitted by the Dynatrace Snowflake Observability Agent shares plugin via the OpenPipeline Events API.

Query

Fetch recent Dynatrace Snowflake Observability Agent shares lifecycle events.

fetch events
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "shares"
| sort timestamp desc
| limit 20

Fetch the most recent Dynatrace Snowflake Observability Agent shares lifecycle events (share, grant and table creation anchors).

fetch events
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "shares"
| sort timestamp desc
| limit 50

Count Dynatrace Snowflake Observability Agent shares lifecycle events grouped by event type.

fetch events
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "shares"
| summarize { events = count() }, by: { snowflake.event.type }
| sort events desc

Dynatrace Snowflake Observability Agent resource fields

Fields present on all Dynatrace Snowflake Observability Agent telemetry records. Synced with config.py RESOURCE_ATTRIBUTES.

Attribute	Type	Description	Examples
`db.system`	string	experimental Display name: `Database system` An identifier for the database management system (DBMS) product being used. See below for a list of well-known identifiers. ¹	`mongodb`; `mysql`
`deployment.environment`	string	resource deprecated Use deployment.environment.name instead. Display name: `Snowflake deployment environment` Deprecated alias for deployment.environment.name. The deployment environment, for example, production, staging, or development. Will be removed in release 1.3.0. ²	`PROD`
`deployment.environment.name`	string	resource stable Display name: `Snowflake deployment environment name` The deployment environment name (OTel semconv canonical field), for example, production, staging, or development. Emitted alongside deployment.environment during the deprecation window. ³	`PROD`
`deployment.environment.tag`	string	resource stable Display name: `Deployment environment tag` Optional tag for the deployment environment in multitenancy mode ⁴	`SA080`
`dsoa.run.context`	string	resource stable Display name: `Dynatrace Snowflake Observability Agent execution context` The name of the Dynatrace Snowflake Observability Agent context (part of plugin) used to produce the telemetry (logs, traces, metrics, or events). In case of multiple contexts within the same plugin, this helps differentiate between them. If plugin delivers only one context, this field will have the same value as the plugin name. ⁵	`users_all_roles`
`dsoa.run.id`	string	resource stable Display name: `Dynatrace Snowflake Observability Agent execution unique identifier` Unique ID of each execution of the Dynatrace Snowflake Observability Agent plugin. It can be used to differentiate between telemetry produced between two executions, for example, to calculate the change in the system. ⁶	`4aa7c76c-e98c-4b8b-a5b3-a8a721bbde2d`
`dsoa.run.plugin`	string	resource stable Display name: `Dynatrace Snowflake Observability Agent execution plugin name` The name of the Dynatrace Snowflake Observability Agent plugin that produced this telemetry. Use to filter all telemetry from a specific plugin (for example, 'query_history', 'warehouse_usage'). Distinct from dsoa.run.context, which may represent a sub-context within a plugin. ⁷	`users`
`host.name`	string	resource experimental Display name: `Host name` The host name as determined on the data source (for instance, OneAgent, extensions or OpenTelemetry). Important: This is not the name of the host entity, which can be modified based on naming rules. ⁸ Tags: `permission`	`ip-10-178-54-32.ec2.internal`
`service.name`	string	resource stable Display name: `OTel service name` The logical name of the service. ⁹	`shoppingcart`
`telemetry.exporter.name`	string	resource experimental Display name: `Telemetry exporter name` The exporter name. ¹⁰	`odin`
`telemetry.exporter.version`	string	resource experimental Display name: `Telemetry exporter version` The full agent/exporter version. ¹¹	`1.285.1.20240101-256988`

Always 'snowflake' for all Dynatrace Snowflake Observability Agent telemetry.

User-configured deployment environment label, for example, 'PROD', 'STG', or 'DEV'. Set via 'core.snowflake.deployment_environment'.

⁴

Optional user-defined tag for grouping Snowflake accounts in multitenancy mode, set via 'core.tag'.

⁵

Identifies the specific sub-context within the plugin (for example, 'query_history', 'users_all_roles').

⁶

Unique identifier for a single Dynatrace Snowflake Observability Agent execution run. Changes on every invocation.

⁷

The Dynatrace Snowflake Observability Agent plugin that produced this telemetry (for example, 'query_history', 'warehouse_usage').

⁸

The Snowflake account hostname (for example, 'xy12345.snowflakecomputing.com'), from 'core.snowflake.host_name'.

⁹

Always the Snowflake account identifier without '.snowflakecomputing.com' suffix (for example, 'myorg-myaccount').

¹⁰

Always 'dynatrace.snowagent' — identifies Dynatrace Snowflake Observability Agent as the telemetry exporter.

¹¹

The installed Dynatrace Snowflake Observability Agent version in <major>.<minor>.<patch>.<build> format.

db.system has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`adabas`	Adabas (Adaptable Database System)	Adabas
`amazon-documentdb`	Amazon DocumentDB	DocumentDB
`aurora-mysql`	Amazon Aurora MySQL	Aurora MySQL
`aurora-postgresql`	Amazon Aurora PostgreSQL	Aurora PostgreSQL
`cache`	InterSystems Caché	InterSystems Caché
`cassandra`	Apache Cassandra	Cassandra
`clickhouse`	ClickHouse	ClickHouse
`cloudscape`	Cloudscape	Cloudscape
`cockroachdb`	CockroachDB	CockroachDB
`coldfusion`	ColdFusion IMQ	ColdFusion IMQ
`cosmosdb`	Microsoft Azure Cosmos DB	Cosmos DB
`couchbase`	Couchbase	Couchbase
`couchdb`	CouchDB	CouchDB
`databricks`	Databricks Data Platform	Databricks Data Platform
`db2`	IBM Db2	IBM Db2
`derby`	Apache Derby	Derby
`dl/i`	IBM DL/I	IBM DL/I
`dynamodb`	Amazon DynamoDB	DynamoDB
`edb`	EnterpriseDB	EnterpriseDB
`elasticsearch`	Elasticsearch	Elasticsearch
`filemaker`	FileMaker	FileMaker
`firebird`	Firebird	Firebird
`firstsql`	FirstSQL	FirstSQL
`geode`	Apache Geode	Geode
`h2`	H2	H2
`hanadb`	SAP HANA	SAP HANA
`hbase`	Apache HBase	HBase
`hive`	Apache Hive	Hive
`hsqldb`	HyperSQL DataBase	HSQLDB
`informix`	Informix	Informix
`ingres`	Ingres	Ingres
`instantdb`	InstantDB	InstantDB
`interbase`	InterBase	InterBase
`keyspaces-cassandra`	Amazon Keyspaces for Apache Cassandra	Keyspaces
`mariadb`	MariaDB	MariaDB
`maxdb`	SAP MaxDB	SAP MaxDB
`memcached`	Memcached	Memcached
`mongodb`	MongoDB	MongoDB
`mssql`	Microsoft SQL Server	SQL Server
`mssqlcompact`	Microsoft SQL Server Compact	SQL Server Compact
`mysql`	MySQL	MySQL
`neo4j`	Neo4j	Neo4j
`neptune`	Amazon Neptune	Neptune
`netezza`	Netezza	Netezza
`opensearch`	OpenSearch	OpenSearch
`oracle`	Oracle Database	Oracle
`other_sql`	Some other SQL database. Fallback only. See notes.	Other SQL
`pervasive`	Pervasive PSQL	Pervasive PSQL
`phoenix`	Apache Phoenix	Apache Phoenix
`pointbase`	PointBase	PointBase
`postgresql`	PostgreSQL	PostgreSQL
`progress`	Progress Database	Progress
`redis`	Redis	Redis
`redshift`	Amazon Redshift	Redshift
`snowflake`	Snowflake Data Platform	Snowflake Data Platform
`spanner`	Cloud Spanner	Cloud Spanner
`sqlite`	SQLite	SQLite
`sybase`	Sybase	Sybase
`teradata`	Teradata	Teradata
`valkey`	Valkey	Valkey
`vertica`	Vertica	Vertica

Shares event fields

Attribute	Type	Description	Examples
`snowflake.event.type`	string	experimental Display name: `Snowflake event type` Type of (timestamp based) event	`snowflake.table.update`
`snowflake.grant.created_on`	long	stable Display name: `Snowflake grant creation time` The timestamp when the grant was created. Epoch nanoseconds timestamp.	`1639051180946000000`
`snowflake.share.created_on`	long	stable Display name: `Snowflake share creation time` The timestamp when the share was created. Epoch nanoseconds timestamp.	`1639051180714000000`
`snowflake.table.created_on`	long	experimental Display name: `Snowflake table creation time` The timestamp when the table was created. Epoch nanoseconds timestamp.	`1649940827875000000`

Snowflake tasks lifecycle events

Timestamp-based state-change events emitted by the Dynatrace Snowflake Observability Agent tasks plugin via the OpenPipeline Events API.

Query

Fetch the most recent Dynatrace Snowflake Observability Agent tasks lifecycle events (task graph version anchors).

fetch events
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "tasks"
| sort timestamp desc
| limit 50

Count Dynatrace Snowflake Observability Agent tasks lifecycle events grouped by event type.

fetch events
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "tasks"
| summarize { events = count() }, by: { snowflake.event.type }
| sort events desc

Inspect task lifecycle events with their task name and event type.

fetch events
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "tasks"
| filter isNotNull(snowflake.task.name)
| fields timestamp, snowflake.event.type, snowflake.task.name
| sort timestamp desc
| limit 25

Dynatrace Snowflake Observability Agent resource fields

Fields present on all Dynatrace Snowflake Observability Agent telemetry records. Synced with config.py RESOURCE_ATTRIBUTES.

Attribute	Type	Description	Examples
`db.system`	string	experimental Display name: `Database system` An identifier for the database management system (DBMS) product being used. See below for a list of well-known identifiers. ¹	`mongodb`; `mysql`
`deployment.environment`	string	resource deprecated Use deployment.environment.name instead. Display name: `Snowflake deployment environment` Deprecated alias for deployment.environment.name. The deployment environment, for example, production, staging, or development. Will be removed in release 1.3.0. ²	`PROD`
`deployment.environment.name`	string	resource stable Display name: `Snowflake deployment environment name` The deployment environment name (OTel semconv canonical field), for example, production, staging, or development. Emitted alongside deployment.environment during the deprecation window. ³	`PROD`
`deployment.environment.tag`	string	resource stable Display name: `Deployment environment tag` Optional tag for the deployment environment in multitenancy mode ⁴	`SA080`
`dsoa.run.context`	string	resource stable Display name: `Dynatrace Snowflake Observability Agent execution context` The name of the Dynatrace Snowflake Observability Agent context (part of plugin) used to produce the telemetry (logs, traces, metrics, or events). In case of multiple contexts within the same plugin, this helps differentiate between them. If plugin delivers only one context, this field will have the same value as the plugin name. ⁵	`users_all_roles`
`dsoa.run.id`	string	resource stable Display name: `Dynatrace Snowflake Observability Agent execution unique identifier` Unique ID of each execution of the Dynatrace Snowflake Observability Agent plugin. It can be used to differentiate between telemetry produced between two executions, for example, to calculate the change in the system. ⁶	`4aa7c76c-e98c-4b8b-a5b3-a8a721bbde2d`
`dsoa.run.plugin`	string	resource stable Display name: `Dynatrace Snowflake Observability Agent execution plugin name` The name of the Dynatrace Snowflake Observability Agent plugin that produced this telemetry. Use to filter all telemetry from a specific plugin (for example, 'query_history', 'warehouse_usage'). Distinct from dsoa.run.context, which may represent a sub-context within a plugin. ⁷	`users`
`host.name`	string	resource experimental Display name: `Host name` The host name as determined on the data source (for instance, OneAgent, extensions or OpenTelemetry). Important: This is not the name of the host entity, which can be modified based on naming rules. ⁸ Tags: `permission`	`ip-10-178-54-32.ec2.internal`
`service.name`	string	resource stable Display name: `OTel service name` The logical name of the service. ⁹	`shoppingcart`
`telemetry.exporter.name`	string	resource experimental Display name: `Telemetry exporter name` The exporter name. ¹⁰	`odin`
`telemetry.exporter.version`	string	resource experimental Display name: `Telemetry exporter version` The full agent/exporter version. ¹¹	`1.285.1.20240101-256988`

Always 'snowflake' for all Dynatrace Snowflake Observability Agent telemetry.

User-configured deployment environment label, for example, 'PROD', 'STG', or 'DEV'. Set via 'core.snowflake.deployment_environment'.

⁴

Optional user-defined tag for grouping Snowflake accounts in multitenancy mode, set via 'core.tag'.

⁵

Identifies the specific sub-context within the plugin (for example, 'query_history', 'users_all_roles').

⁶

Unique identifier for a single Dynatrace Snowflake Observability Agent execution run. Changes on every invocation.

⁷

The Dynatrace Snowflake Observability Agent plugin that produced this telemetry (for example, 'query_history', 'warehouse_usage').

⁸

The Snowflake account hostname (for example, 'xy12345.snowflakecomputing.com'), from 'core.snowflake.host_name'.

⁹

Always the Snowflake account identifier without '.snowflakecomputing.com' suffix (for example, 'myorg-myaccount').

¹⁰

Always 'dynatrace.snowagent' — identifies Dynatrace Snowflake Observability Agent as the telemetry exporter.

¹¹

The installed Dynatrace Snowflake Observability Agent version in <major>.<minor>.<patch>.<build> format.

db.system has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`adabas`	Adabas (Adaptable Database System)	Adabas
`amazon-documentdb`	Amazon DocumentDB	DocumentDB
`aurora-mysql`	Amazon Aurora MySQL	Aurora MySQL
`aurora-postgresql`	Amazon Aurora PostgreSQL	Aurora PostgreSQL
`cache`	InterSystems Caché	InterSystems Caché
`cassandra`	Apache Cassandra	Cassandra
`clickhouse`	ClickHouse	ClickHouse
`cloudscape`	Cloudscape	Cloudscape
`cockroachdb`	CockroachDB	CockroachDB
`coldfusion`	ColdFusion IMQ	ColdFusion IMQ
`cosmosdb`	Microsoft Azure Cosmos DB	Cosmos DB
`couchbase`	Couchbase	Couchbase
`couchdb`	CouchDB	CouchDB
`databricks`	Databricks Data Platform	Databricks Data Platform
`db2`	IBM Db2	IBM Db2
`derby`	Apache Derby	Derby
`dl/i`	IBM DL/I	IBM DL/I
`dynamodb`	Amazon DynamoDB	DynamoDB
`edb`	EnterpriseDB	EnterpriseDB
`elasticsearch`	Elasticsearch	Elasticsearch
`filemaker`	FileMaker	FileMaker
`firebird`	Firebird	Firebird
`firstsql`	FirstSQL	FirstSQL
`geode`	Apache Geode	Geode
`h2`	H2	H2
`hanadb`	SAP HANA	SAP HANA
`hbase`	Apache HBase	HBase
`hive`	Apache Hive	Hive
`hsqldb`	HyperSQL DataBase	HSQLDB
`informix`	Informix	Informix
`ingres`	Ingres	Ingres
`instantdb`	InstantDB	InstantDB
`interbase`	InterBase	InterBase
`keyspaces-cassandra`	Amazon Keyspaces for Apache Cassandra	Keyspaces
`mariadb`	MariaDB	MariaDB
`maxdb`	SAP MaxDB	SAP MaxDB
`memcached`	Memcached	Memcached
`mongodb`	MongoDB	MongoDB
`mssql`	Microsoft SQL Server	SQL Server
`mssqlcompact`	Microsoft SQL Server Compact	SQL Server Compact
`mysql`	MySQL	MySQL
`neo4j`	Neo4j	Neo4j
`neptune`	Amazon Neptune	Neptune
`netezza`	Netezza	Netezza
`opensearch`	OpenSearch	OpenSearch
`oracle`	Oracle Database	Oracle
`other_sql`	Some other SQL database. Fallback only. See notes.	Other SQL
`pervasive`	Pervasive PSQL	Pervasive PSQL
`phoenix`	Apache Phoenix	Apache Phoenix
`pointbase`	PointBase	PointBase
`postgresql`	PostgreSQL	PostgreSQL
`progress`	Progress Database	Progress
`redis`	Redis	Redis
`redshift`	Amazon Redshift	Redshift
`snowflake`	Snowflake Data Platform	Snowflake Data Platform
`spanner`	Cloud Spanner	Cloud Spanner
`sqlite`	SQLite	SQLite
`sybase`	Sybase	Sybase
`teradata`	Teradata	Teradata
`valkey`	Valkey	Valkey
`vertica`	Vertica	Vertica

Tasks event fields

Attribute	Type	Description	Examples
`snowflake.event.type`	string	experimental Display name: `Snowflake event type` Type of (timestamp based) event	`snowflake.table.update`
`snowflake.task.graph.version.created_on`	long	stable Display name: `Snowflake task graph version creation time` The timestamp when the task graph version was created.	`1633046400000000000`

Snowflake users lifecycle events

Timestamp-based state-change events emitted by the Dynatrace Snowflake Observability Agent users plugin via the OpenPipeline Events API.

Query

Fetch recent Dynatrace Snowflake Observability Agent users lifecycle events.

fetch events
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "users"
| sort timestamp desc
| limit 20

Fetch the most recent Dynatrace Snowflake Observability Agent users lifecycle events (creation, deletion and role-change anchors).

fetch events
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "users"
| sort timestamp desc
| limit 50

Count Dynatrace Snowflake Observability Agent users lifecycle events grouped by event type.

fetch events
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "users"
| summarize { events = count() }, by: { snowflake.event.type }
| sort events desc

Dynatrace Snowflake Observability Agent resource fields

Fields present on all Dynatrace Snowflake Observability Agent telemetry records. Synced with config.py RESOURCE_ATTRIBUTES.

Attribute	Type	Description	Examples
`db.system`	string	experimental Display name: `Database system` An identifier for the database management system (DBMS) product being used. See below for a list of well-known identifiers. ¹	`mongodb`; `mysql`
`deployment.environment`	string	resource deprecated Use deployment.environment.name instead. Display name: `Snowflake deployment environment` Deprecated alias for deployment.environment.name. The deployment environment, for example, production, staging, or development. Will be removed in release 1.3.0. ²	`PROD`
`deployment.environment.name`	string	resource stable Display name: `Snowflake deployment environment name` The deployment environment name (OTel semconv canonical field), for example, production, staging, or development. Emitted alongside deployment.environment during the deprecation window. ³	`PROD`
`deployment.environment.tag`	string	resource stable Display name: `Deployment environment tag` Optional tag for the deployment environment in multitenancy mode ⁴	`SA080`
`dsoa.run.context`	string	resource stable Display name: `Dynatrace Snowflake Observability Agent execution context` The name of the Dynatrace Snowflake Observability Agent context (part of plugin) used to produce the telemetry (logs, traces, metrics, or events). In case of multiple contexts within the same plugin, this helps differentiate between them. If plugin delivers only one context, this field will have the same value as the plugin name. ⁵	`users_all_roles`
`dsoa.run.id`	string	resource stable Display name: `Dynatrace Snowflake Observability Agent execution unique identifier` Unique ID of each execution of the Dynatrace Snowflake Observability Agent plugin. It can be used to differentiate between telemetry produced between two executions, for example, to calculate the change in the system. ⁶	`4aa7c76c-e98c-4b8b-a5b3-a8a721bbde2d`
`dsoa.run.plugin`	string	resource stable Display name: `Dynatrace Snowflake Observability Agent execution plugin name` The name of the Dynatrace Snowflake Observability Agent plugin that produced this telemetry. Use to filter all telemetry from a specific plugin (for example, 'query_history', 'warehouse_usage'). Distinct from dsoa.run.context, which may represent a sub-context within a plugin. ⁷	`users`
`host.name`	string	resource experimental Display name: `Host name` The host name as determined on the data source (for instance, OneAgent, extensions or OpenTelemetry). Important: This is not the name of the host entity, which can be modified based on naming rules. ⁸ Tags: `permission`	`ip-10-178-54-32.ec2.internal`
`service.name`	string	resource stable Display name: `OTel service name` The logical name of the service. ⁹	`shoppingcart`
`telemetry.exporter.name`	string	resource experimental Display name: `Telemetry exporter name` The exporter name. ¹⁰	`odin`
`telemetry.exporter.version`	string	resource experimental Display name: `Telemetry exporter version` The full agent/exporter version. ¹¹	`1.285.1.20240101-256988`

Always 'snowflake' for all Dynatrace Snowflake Observability Agent telemetry.

User-configured deployment environment label, for example, 'PROD', 'STG', or 'DEV'. Set via 'core.snowflake.deployment_environment'.

⁴

Optional user-defined tag for grouping Snowflake accounts in multitenancy mode, set via 'core.tag'.

⁵

Identifies the specific sub-context within the plugin (for example, 'query_history', 'users_all_roles').

⁶

Unique identifier for a single Dynatrace Snowflake Observability Agent execution run. Changes on every invocation.

⁷

The Dynatrace Snowflake Observability Agent plugin that produced this telemetry (for example, 'query_history', 'warehouse_usage').

⁸

The Snowflake account hostname (for example, 'xy12345.snowflakecomputing.com'), from 'core.snowflake.host_name'.

⁹

Always the Snowflake account identifier without '.snowflakecomputing.com' suffix (for example, 'myorg-myaccount').

¹⁰

Always 'dynatrace.snowagent' — identifies Dynatrace Snowflake Observability Agent as the telemetry exporter.

¹¹

The installed Dynatrace Snowflake Observability Agent version in <major>.<minor>.<patch>.<build> format.

db.system has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`adabas`	Adabas (Adaptable Database System)	Adabas
`amazon-documentdb`	Amazon DocumentDB	DocumentDB
`aurora-mysql`	Amazon Aurora MySQL	Aurora MySQL
`aurora-postgresql`	Amazon Aurora PostgreSQL	Aurora PostgreSQL
`cache`	InterSystems Caché	InterSystems Caché
`cassandra`	Apache Cassandra	Cassandra
`clickhouse`	ClickHouse	ClickHouse
`cloudscape`	Cloudscape	Cloudscape
`cockroachdb`	CockroachDB	CockroachDB
`coldfusion`	ColdFusion IMQ	ColdFusion IMQ
`cosmosdb`	Microsoft Azure Cosmos DB	Cosmos DB
`couchbase`	Couchbase	Couchbase
`couchdb`	CouchDB	CouchDB
`databricks`	Databricks Data Platform	Databricks Data Platform
`db2`	IBM Db2	IBM Db2
`derby`	Apache Derby	Derby
`dl/i`	IBM DL/I	IBM DL/I
`dynamodb`	Amazon DynamoDB	DynamoDB
`edb`	EnterpriseDB	EnterpriseDB
`elasticsearch`	Elasticsearch	Elasticsearch
`filemaker`	FileMaker	FileMaker
`firebird`	Firebird	Firebird
`firstsql`	FirstSQL	FirstSQL
`geode`	Apache Geode	Geode
`h2`	H2	H2
`hanadb`	SAP HANA	SAP HANA
`hbase`	Apache HBase	HBase
`hive`	Apache Hive	Hive
`hsqldb`	HyperSQL DataBase	HSQLDB
`informix`	Informix	Informix
`ingres`	Ingres	Ingres
`instantdb`	InstantDB	InstantDB
`interbase`	InterBase	InterBase
`keyspaces-cassandra`	Amazon Keyspaces for Apache Cassandra	Keyspaces
`mariadb`	MariaDB	MariaDB
`maxdb`	SAP MaxDB	SAP MaxDB
`memcached`	Memcached	Memcached
`mongodb`	MongoDB	MongoDB
`mssql`	Microsoft SQL Server	SQL Server
`mssqlcompact`	Microsoft SQL Server Compact	SQL Server Compact
`mysql`	MySQL	MySQL
`neo4j`	Neo4j	Neo4j
`neptune`	Amazon Neptune	Neptune
`netezza`	Netezza	Netezza
`opensearch`	OpenSearch	OpenSearch
`oracle`	Oracle Database	Oracle
`other_sql`	Some other SQL database. Fallback only. See notes.	Other SQL
`pervasive`	Pervasive PSQL	Pervasive PSQL
`phoenix`	Apache Phoenix	Apache Phoenix
`pointbase`	PointBase	PointBase
`postgresql`	PostgreSQL	PostgreSQL
`progress`	Progress Database	Progress
`redis`	Redis	Redis
`redshift`	Amazon Redshift	Redshift
`snowflake`	Snowflake Data Platform	Snowflake Data Platform
`spanner`	Cloud Spanner	Cloud Spanner
`sqlite`	SQLite	SQLite
`sybase`	Sybase	Sybase
`teradata`	Teradata	Teradata
`valkey`	Valkey	Valkey
`vertica`	Vertica	Vertica

Users event fields

Attribute	Type	Description	Examples
`snowflake.event.type`	string	experimental Display name: `Snowflake event type` Type of (timestamp based) event	`snowflake.table.update`
`snowflake.user.created_on`	long	experimental Display name: `Snowflake user account creation time` The timestamp of the user account creation.	`1651830381846000000`
`snowflake.user.deleted_on`	long	experimental Display name: `Snowflake user account deletion time` The timestamp of the user account deletion.	`1615219846384000000`
`snowflake.user.last_success_login`	long	stable Display name: `Snowflake user last successful login time` The timestamp of the last successful login by the user.	`1732181350954000000`
`snowflake.user.password_last_set_time`	long	experimental Display name: `Snowflake user password last set time` The timestamp of the last password change for the user.	`1615219848053000000`
`snowflake.user.privilege.last_altered`	long	experimental Display name: `Snowflake user privilege last altered time` The timestamp of the last alteration to the user's privileges.	`1732181350954000000`
`snowflake.user.roles.direct.removed_on`	long	experimental Display name: `Snowflake user direct role removal time` The timestamp of the last removal of a direct role from the user.	`1718260900411000000`
`snowflake.user.roles.last_altered`	long	experimental Display name: `Snowflake user roles last altered time` The timestamp of the last alteration to the roles granted to the user.	`1718260900411000000`