Snowflake log records

Latest Dynatrace
Reference

Log records emitted by Dynatrace Snowflake Observability Agent plugins from Snowflake ACCOUNT_USAGE and system views.

Query

Fetch the 100 most recent Dynatrace Snowflake Observability Agent metering plugin log entries from Grail.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "metering"
| sort timestamp desc
| limit 100

Inspect per-service credit consumption readings from the metering plugin.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "metering"
| filter isNotNull(snowflake.service.name)
| fields timestamp, snowflake.service.name, snowflake.service.type, snowflake.credits.used
| sort timestamp desc
| limit 50

Rank Snowflake services by total metered credit consumption.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "metering"
| filter isNotNull(snowflake.service.name)
| summarize { total_credits = sum(toDouble(snowflake.credits.used)) }, by: { snowflake.service.name }
| sort total_credits desc
| limit 25

Snowflake Resource Monitors log records

Log records emitted by the Dynatrace Snowflake Observability Agent resource_monitors plugin.

Query

Fetch the 100 most recent Dynatrace Snowflake Observability Agent resource_monitors plugin log entries from Grail.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "resource_monitors"
| sort timestamp desc
| limit 100

Inspect per-monitor credit quota consumption readings from the resource_monitors plugin.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "resource_monitors"
| filter isNotNull(snowflake.resource_monitor.name)
| fields timestamp, snowflake.resource_monitor.name, snowflake.credits.quota.used, snowflake.credits.quota.used_pct
| sort timestamp desc
| limit 50

Fetch resource monitors that have consumed more than 90% of their credit quota.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "resource_monitors"
| filter toDouble(snowflake.credits.quota.used_pct) > 90
| sort timestamp desc
| limit 50

Dynatrace Snowflake Observability Agent resource fields

Fields present on all Dynatrace Snowflake Observability Agent telemetry records. Synced with config.py RESOURCE_ATTRIBUTES.

Attribute	Type	Description	Examples
`db.system`	string	experimental Display name: `Database system` An identifier for the database management system (DBMS) product being used. See below for a list of well-known identifiers. ¹	`mongodb`; `mysql`
`deployment.environment`	string	resource deprecatedUse deployment.environment.name instead. Deprecated alias for deployment.environment.name. The deployment environment, for example, production, staging, or development. Will be removed in release 1.3.0. ²	`PROD`
`deployment.environment.name`	string	resource stable The deployment environment name (OTel semconv canonical field), for example, production, staging, or development. Emitted alongside deployment.environment during the deprecation window. ³	`PROD`
`deployment.environment.tag`	string	resource stable Optional tag for the deployment environment in multitenancy mode ⁴	`SA080`
`dsoa.run.context`	string	resource stable The name of the Dynatrace Snowflake Observability Agent context (part of plugin) used to produce the telemetry (logs, traces, metrics, or events). In case of multiple contexts within the same plugin, this helps differentiate between them. If plugin delivers only one context, this field will have the same value as the plugin name. ⁵	`users_all_roles`
`dsoa.run.id`	string	resource stable Unique ID of each execution of the Dynatrace Snowflake Observability Agent plugin. It can be used to differentiate between telemetry produced between two executions, for example, to calculate the change in the system. ⁶	`4aa7c76c-e98c-4b8b-a5b3-a8a721bbde2d`
`dsoa.run.plugin`	string	resource stable The name of the Dynatrace Snowflake Observability Agent plugin that produced this telemetry. Use to filter all telemetry from a specific plugin (for example, 'query_history', 'warehouse_usage'). Distinct from dsoa.run.context, which may represent a sub-context within a plugin. ⁷	`users`
`host.name`	string	resource experimental Display name: `Host name` The host name as determined on the data source (for instance, OneAgent, extensions or OpenTelemetry). Important: This is not the name of the host entity, which can be modified based on naming rules. ⁸ Tags: `permission`	`ip-10-178-54-32.ec2.internal`
`service.name`	string	resource stable Display name: `OTel service name` The logical name of the service. ⁹	`shoppingcart`
`telemetry.exporter.name`	string	resource experimental Display name: `Telemetry exporter name` The exporter name. ¹⁰	`odin`
`telemetry.exporter.version`	string	resource experimental Display name: `Telemetry exporter version` The full agent/exporter version. ¹¹	`1.285.1.20240101-256988`

Always 'snowflake' for all Dynatrace Snowflake Observability Agent telemetry.

User-configured deployment environment label, for example, 'PROD', 'STG', or 'DEV'. Set via 'core.snowflake.deployment_environment'.

User-configured deployment environment label (OTel-stable canonical key), for example, 'PROD', 'STG', or 'DEV'. Set via 'core.snowflake.deployment_environment'. Prefer this key over the deprecated deployment.environment alias.

⁴

Optional user-defined tag for grouping Snowflake accounts in multitenancy mode, set via 'core.tag'.

⁵

Identifies the specific sub-context within the plugin (for example, 'query_history', 'users_all_roles').

⁶

Unique identifier for a single Dynatrace Snowflake Observability Agent execution run. Changes on every invocation.

⁷

The Dynatrace Snowflake Observability Agent plugin that produced this telemetry (for example, 'query_history', 'warehouse_usage').

⁸

The Snowflake account hostname (for example, 'xy12345.snowflakecomputing.com'), from 'core.snowflake.host_name'.

⁹

Always the Snowflake account identifier without '.snowflakecomputing.com' suffix (for example, 'myorg-myaccount').

¹⁰

Always 'dynatrace.snowagent' — identifies Dynatrace Snowflake Observability Agent as the telemetry exporter.

¹¹

The installed Dynatrace Snowflake Observability Agent version in <major>.<minor>.<patch>.<build> format.

db.system has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`adabas`	Adabas (Adaptable Database System)	Adabas
`amazon-documentdb`	Amazon DocumentDB	DocumentDB
`aurora-mysql`	Amazon Aurora MySQL	Aurora MySQL
`aurora-postgresql`	Amazon Aurora PostgreSQL	Aurora PostgreSQL
`cache`	InterSystems Caché	InterSystems Caché
`cassandra`	Apache Cassandra	Cassandra
`clickhouse`	ClickHouse	ClickHouse
`cloudscape`	Cloudscape	Cloudscape
`cockroachdb`	CockroachDB	CockroachDB
`coldfusion`	ColdFusion IMQ	ColdFusion IMQ
`cosmosdb`	Microsoft Azure Cosmos DB	Cosmos DB
`couchbase`	Couchbase	Couchbase
`couchdb`	CouchDB	CouchDB
`databricks`	Databricks Data Platform	Databricks Data Platform
`db2`	IBM Db2	IBM Db2
`derby`	Apache Derby	Derby
`dl/i`	IBM DL/I	IBM DL/I
`dynamodb`	Amazon DynamoDB	DynamoDB
`edb`	EnterpriseDB	EnterpriseDB
`elasticsearch`	Elasticsearch	Elasticsearch
`filemaker`	FileMaker	FileMaker
`firebird`	Firebird	Firebird
`firstsql`	FirstSQL	FirstSQL
`geode`	Apache Geode	Geode
`h2`	H2	H2
`hanadb`	SAP HANA	SAP HANA
`hbase`	Apache HBase	HBase
`hive`	Apache Hive	Hive
`hsqldb`	HyperSQL DataBase	HSQLDB
`informix`	Informix	Informix
`ingres`	Ingres	Ingres
`instantdb`	InstantDB	InstantDB
`interbase`	InterBase	InterBase
`keyspaces-cassandra`	Amazon Keyspaces for Apache Cassandra	Keyspaces
`mariadb`	MariaDB	MariaDB
`maxdb`	SAP MaxDB	SAP MaxDB
`memcached`	Memcached	Memcached
`mongodb`	MongoDB	MongoDB
`mssql`	Microsoft SQL Server	SQL Server
`mssqlcompact`	Microsoft SQL Server Compact	SQL Server Compact
`mysql`	MySQL	MySQL
`neo4j`	Neo4j	Neo4j
`neptune`	Amazon Neptune	Neptune
`netezza`	Netezza	Netezza
`opensearch`	OpenSearch	OpenSearch
`oracle`	Oracle Database	Oracle
`other_sql`	Some other SQL database. Fallback only. See notes.	Other SQL
`pervasive`	Pervasive PSQL	Pervasive PSQL
`phoenix`	Apache Phoenix	Apache Phoenix
`pointbase`	PointBase	PointBase
`postgresql`	PostgreSQL	PostgreSQL
`progress`	Progress Database	Progress
`redis`	Redis	Redis
`redshift`	Amazon Redshift	Redshift
`snowflake`	Snowflake Data Platform	Snowflake Data Platform
`spanner`	Cloud Spanner	Cloud Spanner
`sqlite`	SQLite	SQLite
`sybase`	Sybase	Sybase
`teradata`	Teradata	Teradata
`valkey`	Valkey	Valkey
`vertica`	Vertica	Vertica

Resource Monitors log record fields

Attribute fields for Resource Monitors log records.

Attribute	Type	Description	Examples
`snowflake.resource_monitor.frequency`	string	resource stable The frequency of the resource monitor.	`DAILY`
`snowflake.resource_monitor.is_active`	boolean	stable Indicates if the resource monitor is active.	`true`
`snowflake.resource_monitor.level`	string	resource experimental The level of the resource monitor.	`ACCOUNT`
`snowflake.resource_monitor.threshold.direction`	string	experimental Direction of the threshold crossing: `up` when quota is increasing into or remaining within a band; `down` when the consumption drops back below a previously active band.	`up`
`snowflake.resource_monitor.threshold.level`	string	experimental Alert band for the threshold event.	`warn`
`snowflake.resource_monitor.threshold.value`	double	experimental Alert band the resource monitor's credit usage fell into when the event was emitted: one of `info`, `warn`, `critical`, or `exhausted` (increasing severity). The percentage boundaries for each band are configurable via `plugins.resource\_monitors.credits\_quota\_thresholds` (default `[50, 80, 90, 100]`); the specific crossed percentage is reported in `snowflake.resource\_monitor.threshold.value`. The configured threshold percentage at which this crossing event was triggered (for example, 80 means the 80% threshold was crossed). Distinct from snowflake.credits.quota.used_pct, which captures live consumption at emit time.	`80.0`
`snowflake.resource_monitor.warehouses`	string[]	experimental The names of the warehouses monitored.	`['COMPUTE_WH']`
`snowflake.warehouse.event.trigger`	string	experimental The event that triggered the "warehouse is not monitored" notification.	`snowflake.warehouse.created_on`
`snowflake.warehouse.execution_state`	string	resource stable The execution state of the warehouse.	`RUNNING`
`snowflake.warehouse.has_query_acceleration_enabled`	boolean	resource experimental Indicates if query acceleration is enabled for the warehouse.	`true`
`snowflake.warehouse.is_auto_resume`	boolean	resource stable Indicates if the warehouse is set to auto-resume.	`true`
`snowflake.warehouse.is_current`	boolean	experimental Indicates if the warehouse is the current warehouse.	`true`
`snowflake.warehouse.is_default`	boolean	experimental Indicates if the warehouse is the default warehouse.	`true`
`snowflake.warehouse.is_unmonitored`	boolean	stable Indicates if the warehouse is NOT monitored by a resource monitor.	`true`
`snowflake.warehouse.owner.name`	string	resource experimental The owner of the warehouse.	`ADMIN`
`snowflake.warehouse.owner.role_type`	string	experimental The principal type of the warehouse owner: ROLE or APPLICATION.	`ROLE`
`snowflake.warehouse.scaling_policy`	string	resource stable The scaling policy of the warehouse.	`STANDARD`

Snowflake Snowpipes log records

Log records emitted by the Dynatrace Snowflake Observability Agent snowpipes plugin.

Query

Fetch the 100 most recent Dynatrace Snowflake Observability Agent snowpipes plugin log entries from Grail.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "snowpipes"
| sort timestamp desc
| limit 100

Fetch Snowpipe readings that reported ingestion errors.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "snowpipes"
| filter toLong(snowflake.pipe.errors) > 0
| fields timestamp, snowflake.pipe.name, snowflake.pipe.errors, snowflake.pipe.files.pending
| sort timestamp desc
| limit 50

Rank Snowpipes by total rows loaded.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "snowpipes"
| filter isNotNull(snowflake.pipe.name)
| summarize { total_rows = sum(toLong(snowflake.pipe.rows.loaded)) }, by: { snowflake.pipe.name }
| sort total_rows desc
| limit 25

Dynatrace Snowflake Observability Agent resource fields

Fields present on all Dynatrace Snowflake Observability Agent telemetry records. Synced with config.py RESOURCE_ATTRIBUTES.

Attribute	Type	Description	Examples
`db.system`	string	experimental Display name: `Database system` An identifier for the database management system (DBMS) product being used. See below for a list of well-known identifiers. ¹	`mongodb`; `mysql`
`deployment.environment`	string	resource deprecatedUse deployment.environment.name instead. Deprecated alias for deployment.environment.name. The deployment environment, for example, production, staging, or development. Will be removed in release 1.3.0. ²	`PROD`
`deployment.environment.name`	string	resource stable The deployment environment name (OTel semconv canonical field), for example, production, staging, or development. Emitted alongside deployment.environment during the deprecation window. ³	`PROD`
`deployment.environment.tag`	string	resource stable Optional tag for the deployment environment in multitenancy mode ⁴	`SA080`
`dsoa.run.context`	string	resource stable The name of the Dynatrace Snowflake Observability Agent context (part of plugin) used to produce the telemetry (logs, traces, metrics, or events). In case of multiple contexts within the same plugin, this helps differentiate between them. If plugin delivers only one context, this field will have the same value as the plugin name. ⁵	`users_all_roles`
`dsoa.run.id`	string	resource stable Unique ID of each execution of the Dynatrace Snowflake Observability Agent plugin. It can be used to differentiate between telemetry produced between two executions, for example, to calculate the change in the system. ⁶	`4aa7c76c-e98c-4b8b-a5b3-a8a721bbde2d`
`dsoa.run.plugin`	string	resource stable The name of the Dynatrace Snowflake Observability Agent plugin that produced this telemetry. Use to filter all telemetry from a specific plugin (for example, 'query_history', 'warehouse_usage'). Distinct from dsoa.run.context, which may represent a sub-context within a plugin. ⁷	`users`
`host.name`	string	resource experimental Display name: `Host name` The host name as determined on the data source (for instance, OneAgent, extensions or OpenTelemetry). Important: This is not the name of the host entity, which can be modified based on naming rules. ⁸ Tags: `permission`	`ip-10-178-54-32.ec2.internal`
`service.name`	string	resource stable Display name: `OTel service name` The logical name of the service. ⁹	`shoppingcart`
`telemetry.exporter.name`	string	resource experimental Display name: `Telemetry exporter name` The exporter name. ¹⁰	`odin`
`telemetry.exporter.version`	string	resource experimental Display name: `Telemetry exporter version` The full agent/exporter version. ¹¹	`1.285.1.20240101-256988`

Always 'snowflake' for all Dynatrace Snowflake Observability Agent telemetry.

User-configured deployment environment label, for example, 'PROD', 'STG', or 'DEV'. Set via 'core.snowflake.deployment_environment'.

⁴

Optional user-defined tag for grouping Snowflake accounts in multitenancy mode, set via 'core.tag'.

⁵

Identifies the specific sub-context within the plugin (for example, 'query_history', 'users_all_roles').

⁶

Unique identifier for a single Dynatrace Snowflake Observability Agent execution run. Changes on every invocation.

⁷

The Dynatrace Snowflake Observability Agent plugin that produced this telemetry (for example, 'query_history', 'warehouse_usage').

⁸

The Snowflake account hostname (for example, 'xy12345.snowflakecomputing.com'), from 'core.snowflake.host_name'.

⁹

Always the Snowflake account identifier without '.snowflakecomputing.com' suffix (for example, 'myorg-myaccount').

¹⁰

Always 'dynatrace.snowagent' — identifies Dynatrace Snowflake Observability Agent as the telemetry exporter.

¹¹

The installed Dynatrace Snowflake Observability Agent version in <major>.<minor>.<patch>.<build> format.

db.system has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`adabas`	Adabas (Adaptable Database System)	Adabas
`amazon-documentdb`	Amazon DocumentDB	DocumentDB
`aurora-mysql`	Amazon Aurora MySQL	Aurora MySQL
`aurora-postgresql`	Amazon Aurora PostgreSQL	Aurora PostgreSQL
`cache`	InterSystems Caché	InterSystems Caché
`cassandra`	Apache Cassandra	Cassandra
`clickhouse`	ClickHouse	ClickHouse
`cloudscape`	Cloudscape	Cloudscape
`cockroachdb`	CockroachDB	CockroachDB
`coldfusion`	ColdFusion IMQ	ColdFusion IMQ
`cosmosdb`	Microsoft Azure Cosmos DB	Cosmos DB
`couchbase`	Couchbase	Couchbase
`couchdb`	CouchDB	CouchDB
`databricks`	Databricks Data Platform	Databricks Data Platform
`db2`	IBM Db2	IBM Db2
`derby`	Apache Derby	Derby
`dl/i`	IBM DL/I	IBM DL/I
`dynamodb`	Amazon DynamoDB	DynamoDB
`edb`	EnterpriseDB	EnterpriseDB
`elasticsearch`	Elasticsearch	Elasticsearch
`filemaker`	FileMaker	FileMaker
`firebird`	Firebird	Firebird
`firstsql`	FirstSQL	FirstSQL
`geode`	Apache Geode	Geode
`h2`	H2	H2
`hanadb`	SAP HANA	SAP HANA
`hbase`	Apache HBase	HBase
`hive`	Apache Hive	Hive
`hsqldb`	HyperSQL DataBase	HSQLDB
`informix`	Informix	Informix
`ingres`	Ingres	Ingres
`instantdb`	InstantDB	InstantDB
`interbase`	InterBase	InterBase
`keyspaces-cassandra`	Amazon Keyspaces for Apache Cassandra	Keyspaces
`mariadb`	MariaDB	MariaDB
`maxdb`	SAP MaxDB	SAP MaxDB
`memcached`	Memcached	Memcached
`mongodb`	MongoDB	MongoDB
`mssql`	Microsoft SQL Server	SQL Server
`mssqlcompact`	Microsoft SQL Server Compact	SQL Server Compact
`mysql`	MySQL	MySQL
`neo4j`	Neo4j	Neo4j
`neptune`	Amazon Neptune	Neptune
`netezza`	Netezza	Netezza
`opensearch`	OpenSearch	OpenSearch
`oracle`	Oracle Database	Oracle
`other_sql`	Some other SQL database. Fallback only. See notes.	Other SQL
`pervasive`	Pervasive PSQL	Pervasive PSQL
`phoenix`	Apache Phoenix	Apache Phoenix
`pointbase`	PointBase	PointBase
`postgresql`	PostgreSQL	PostgreSQL
`progress`	Progress Database	Progress
`redis`	Redis	Redis
`redshift`	Amazon Redshift	Redshift
`snowflake`	Snowflake Data Platform	Snowflake Data Platform
`spanner`	Cloud Spanner	Cloud Spanner
`sqlite`	SQLite	SQLite
`sybase`	Sybase	Sybase
`teradata`	Teradata	Teradata
`valkey`	Valkey	Valkey
`vertica`	Vertica	Vertica

Snowpipes log record fields

Attribute fields for Snowpipes log records.

Attribute	Type	Description	Examples
`snowflake.copy.errors.limit`	long	experimental Error limit for the COPY.	`1`
`snowflake.copy.file_name`	string	experimental Source file name.	`data/file_20250312.csv.gz`
`snowflake.copy.first_commit_time`	long	experimental When the first chunk of the file was committed.	`1741772160000000000`
`snowflake.copy.first_error.character_position`	long	experimental Character position of first error.	`128`
`snowflake.copy.first_error.column_name`	string	experimental Column name causing the first error.	`AMOUNT`
`snowflake.copy.first_error.line_number`	long	experimental Line number of first error.	`42`
`snowflake.copy.first_error.message`	string	experimental First error message for failed loads.	`Number of columns in file (3) does not match that of the corresponding table (4)`
`snowflake.copy.pipe.received_time`	long	experimental When file was received by Snowpipe (view-only).	`1741772100000000000`
`snowflake.copy.stage_location`	string	experimental Stage location (ACCOUNT_USAGE view-only).	`s3://my-bucket/data/`
`snowflake.copy.status`	string	experimental Load status of the COPY INTO operation.	`LOADED`
`snowflake.pipe.definition`	string	experimental The pipe's COPY statement.	`COPY INTO MY_DB.MY_SCHEMA.TARGET_TABLE FROM @MY_DB.MY_SCHEMA.MY_STAGE`
`snowflake.pipe.execution_state`	string	stable Raw execution state from `SYSTEM$PIPE\_STATUS`.	`RUNNING`
`snowflake.pipe.invalid_reason`	string	experimental Reason the pipe is in an invalid state.	`Pipe paused by user`
`snowflake.pipe.last_ingested_timestamp`	string	experimental Most recent file ingestion timestamp.	`2025-03-12 08:58:41.695 Z`
`snowflake.pipe.last_received_message_timestamp`	string	experimental Most recent event notification timestamp.	`2025-03-12 08:57:30.000 Z`
`snowflake.pipe.notification_channel`	string	experimental Cloud notification channel URL.	`arn:aws:sqs:us-east-1:123456789012:sf-snowpipe-AIDAEXAMPLE-pipeId`
`snowflake.pipe.oldest_file_timestamp`	string	experimental Timestamp of oldest pending file.	`2025-03-12 08:50:00.000 Z`
`snowflake.pipe.usage.start_time`	string	experimental Start of the usage aggregation window.	`2025-03-12 08:00:00.000 Z`

Snowflake Trust Center log records

Log records emitted by the Dynatrace Snowflake Observability Agent trust_center plugin.

Query

Fetch the 100 most recent Dynatrace Snowflake Observability Agent trust_center plugin log entries from Grail.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "trust_center"
| sort timestamp desc
| limit 100

Fetch critical-severity Trust Center findings reported by the trust_center plugin.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "trust_center"
| filter vulnerability.risk.level == "CRITICAL"
| sort timestamp desc
| limit 50

Break down Trust Center findings by scanner type and risk level.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "trust_center"
| summarize { findings = count() }, by: { snowflake.trust_center.scanner.type, vulnerability.risk.level }
| sort findings desc
| limit 25

Dynatrace Snowflake Observability Agent resource fields

Fields present on all Dynatrace Snowflake Observability Agent telemetry records. Synced with config.py RESOURCE_ATTRIBUTES.

Attribute	Type	Description	Examples
`db.system`	string	experimental Display name: `Database system` An identifier for the database management system (DBMS) product being used. See below for a list of well-known identifiers. ¹	`mongodb`; `mysql`
`deployment.environment`	string	resource deprecatedUse deployment.environment.name instead. Deprecated alias for deployment.environment.name. The deployment environment, for example, production, staging, or development. Will be removed in release 1.3.0. ²	`PROD`
`deployment.environment.name`	string	resource stable The deployment environment name (OTel semconv canonical field), for example, production, staging, or development. Emitted alongside deployment.environment during the deprecation window. ³	`PROD`
`deployment.environment.tag`	string	resource stable Optional tag for the deployment environment in multitenancy mode ⁴	`SA080`
`dsoa.run.context`	string	resource stable The name of the Dynatrace Snowflake Observability Agent context (part of plugin) used to produce the telemetry (logs, traces, metrics, or events). In case of multiple contexts within the same plugin, this helps differentiate between them. If plugin delivers only one context, this field will have the same value as the plugin name. ⁵	`users_all_roles`
`dsoa.run.id`	string	resource stable Unique ID of each execution of the Dynatrace Snowflake Observability Agent plugin. It can be used to differentiate between telemetry produced between two executions, for example, to calculate the change in the system. ⁶	`4aa7c76c-e98c-4b8b-a5b3-a8a721bbde2d`
`dsoa.run.plugin`	string	resource stable The name of the Dynatrace Snowflake Observability Agent plugin that produced this telemetry. Use to filter all telemetry from a specific plugin (for example, 'query_history', 'warehouse_usage'). Distinct from dsoa.run.context, which may represent a sub-context within a plugin. ⁷	`users`
`host.name`	string	resource experimental Display name: `Host name` The host name as determined on the data source (for instance, OneAgent, extensions or OpenTelemetry). Important: This is not the name of the host entity, which can be modified based on naming rules. ⁸ Tags: `permission`	`ip-10-178-54-32.ec2.internal`
`service.name`	string	resource stable Display name: `OTel service name` The logical name of the service. ⁹	`shoppingcart`
`telemetry.exporter.name`	string	resource experimental Display name: `Telemetry exporter name` The exporter name. ¹⁰	`odin`
`telemetry.exporter.version`	string	resource experimental Display name: `Telemetry exporter version` The full agent/exporter version. ¹¹	`1.285.1.20240101-256988`

Always 'snowflake' for all Dynatrace Snowflake Observability Agent telemetry.

User-configured deployment environment label, for example, 'PROD', 'STG', or 'DEV'. Set via 'core.snowflake.deployment_environment'.

⁴

Optional user-defined tag for grouping Snowflake accounts in multitenancy mode, set via 'core.tag'.

⁵

Identifies the specific sub-context within the plugin (for example, 'query_history', 'users_all_roles').

⁶

Unique identifier for a single Dynatrace Snowflake Observability Agent execution run. Changes on every invocation.

⁷

The Dynatrace Snowflake Observability Agent plugin that produced this telemetry (for example, 'query_history', 'warehouse_usage').

⁸

The Snowflake account hostname (for example, 'xy12345.snowflakecomputing.com'), from 'core.snowflake.host_name'.

⁹

Always the Snowflake account identifier without '.snowflakecomputing.com' suffix (for example, 'myorg-myaccount').

¹⁰

Always 'dynatrace.snowagent' — identifies Dynatrace Snowflake Observability Agent as the telemetry exporter.

¹¹

The installed Dynatrace Snowflake Observability Agent version in <major>.<minor>.<patch>.<build> format.

db.system has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`adabas`	Adabas (Adaptable Database System)	Adabas
`amazon-documentdb`	Amazon DocumentDB	DocumentDB
`aurora-mysql`	Amazon Aurora MySQL	Aurora MySQL
`aurora-postgresql`	Amazon Aurora PostgreSQL	Aurora PostgreSQL
`cache`	InterSystems Caché	InterSystems Caché
`cassandra`	Apache Cassandra	Cassandra
`clickhouse`	ClickHouse	ClickHouse
`cloudscape`	Cloudscape	Cloudscape
`cockroachdb`	CockroachDB	CockroachDB
`coldfusion`	ColdFusion IMQ	ColdFusion IMQ
`cosmosdb`	Microsoft Azure Cosmos DB	Cosmos DB
`couchbase`	Couchbase	Couchbase
`couchdb`	CouchDB	CouchDB
`databricks`	Databricks Data Platform	Databricks Data Platform
`db2`	IBM Db2	IBM Db2
`derby`	Apache Derby	Derby
`dl/i`	IBM DL/I	IBM DL/I
`dynamodb`	Amazon DynamoDB	DynamoDB
`edb`	EnterpriseDB	EnterpriseDB
`elasticsearch`	Elasticsearch	Elasticsearch
`filemaker`	FileMaker	FileMaker
`firebird`	Firebird	Firebird
`firstsql`	FirstSQL	FirstSQL
`geode`	Apache Geode	Geode
`h2`	H2	H2
`hanadb`	SAP HANA	SAP HANA
`hbase`	Apache HBase	HBase
`hive`	Apache Hive	Hive
`hsqldb`	HyperSQL DataBase	HSQLDB
`informix`	Informix	Informix
`ingres`	Ingres	Ingres
`instantdb`	InstantDB	InstantDB
`interbase`	InterBase	InterBase
`keyspaces-cassandra`	Amazon Keyspaces for Apache Cassandra	Keyspaces
`mariadb`	MariaDB	MariaDB
`maxdb`	SAP MaxDB	SAP MaxDB
`memcached`	Memcached	Memcached
`mongodb`	MongoDB	MongoDB
`mssql`	Microsoft SQL Server	SQL Server
`mssqlcompact`	Microsoft SQL Server Compact	SQL Server Compact
`mysql`	MySQL	MySQL
`neo4j`	Neo4j	Neo4j
`neptune`	Amazon Neptune	Neptune
`netezza`	Netezza	Netezza
`opensearch`	OpenSearch	OpenSearch
`oracle`	Oracle Database	Oracle
`other_sql`	Some other SQL database. Fallback only. See notes.	Other SQL
`pervasive`	Pervasive PSQL	Pervasive PSQL
`phoenix`	Apache Phoenix	Apache Phoenix
`pointbase`	PointBase	PointBase
`postgresql`	PostgreSQL	PostgreSQL
`progress`	Progress Database	Progress
`redis`	Redis	Redis
`redshift`	Amazon Redshift	Redshift
`snowflake`	Snowflake Data Platform	Snowflake Data Platform
`spanner`	Cloud Spanner	Cloud Spanner
`sqlite`	SQLite	SQLite
`sybase`	Sybase	Sybase
`teradata`	Teradata	Teradata
`valkey`	Valkey	Valkey
`vertica`	Vertica	Vertica

Trust Center log record fields

Attribute fields for Trust Center log records.

Attribute	Type	Description	Examples
`snowflake.entity.details`	string	stable Additional details about the entity involved in the event.	`Contains user data`
`snowflake.entity.id`	string	experimental The unique identifier for the entity involved in the event.	`entity123`
`snowflake.entity.name`	string	stable The name of the entity involved in the event.	`User Table`
`snowflake.entity.type`	string	experimental The type of entity involved in the event, such as a table, view, or user.	`table`
`snowflake.trust_center.scanner.description`	string	experimental A short description of the scanner used in the Trust Center.	`Ensure monitoring and alerting exist for password sign-in without MFA`
`snowflake.trust_center.scanner.name`	string	experimental The name of the scanner used in the Trust Center.	`2.4`
`snowflake.trust_center.scanner.package.name`	string	experimental The name of the scanner package used in the Trust Center.	`CIS Package`

Snowflake active queries log records

Log records emitted by the Dynatrace Snowflake Observability Agent active_queries plugin.

Query

Fetch the 100 most recent Dynatrace Snowflake Observability Agent active_queries plugin log entries from Grail.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "active_queries"
| sort timestamp desc
| limit 100

Fetch the 50 most recent active queries that failed with an error.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "active_queries"
| filter snowflake.query.execution_status == "FAILED_WITH_ERROR"
| sort timestamp desc
| limit 50

Rank warehouses by the average running time of their currently active Snowflake queries.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "active_queries"
| filter isNotNull(snowflake.warehouse.name)
| summarize { count = count(), avg_running_ms = avg(toLong(snowflake.time.running)) }, by: { snowflake.warehouse.name }
| sort avg_running_ms desc
| limit 20

Dynatrace Snowflake Observability Agent resource fields

Fields present on all Dynatrace Snowflake Observability Agent telemetry records. Synced with config.py RESOURCE_ATTRIBUTES.

Attribute	Type	Description	Examples
`db.system`	string	experimental Display name: `Database system` An identifier for the database management system (DBMS) product being used. See below for a list of well-known identifiers. ¹	`mongodb`; `mysql`
`deployment.environment`	string	resource deprecatedUse deployment.environment.name instead. Deprecated alias for deployment.environment.name. The deployment environment, for example, production, staging, or development. Will be removed in release 1.3.0. ²	`PROD`
`deployment.environment.name`	string	resource stable The deployment environment name (OTel semconv canonical field), for example, production, staging, or development. Emitted alongside deployment.environment during the deprecation window. ³	`PROD`
`deployment.environment.tag`	string	resource stable Optional tag for the deployment environment in multitenancy mode ⁴	`SA080`
`dsoa.run.context`	string	resource stable The name of the Dynatrace Snowflake Observability Agent context (part of plugin) used to produce the telemetry (logs, traces, metrics, or events). In case of multiple contexts within the same plugin, this helps differentiate between them. If plugin delivers only one context, this field will have the same value as the plugin name. ⁵	`users_all_roles`
`dsoa.run.id`	string	resource stable Unique ID of each execution of the Dynatrace Snowflake Observability Agent plugin. It can be used to differentiate between telemetry produced between two executions, for example, to calculate the change in the system. ⁶	`4aa7c76c-e98c-4b8b-a5b3-a8a721bbde2d`
`dsoa.run.plugin`	string	resource stable The name of the Dynatrace Snowflake Observability Agent plugin that produced this telemetry. Use to filter all telemetry from a specific plugin (for example, 'query_history', 'warehouse_usage'). Distinct from dsoa.run.context, which may represent a sub-context within a plugin. ⁷	`users`
`host.name`	string	resource experimental Display name: `Host name` The host name as determined on the data source (for instance, OneAgent, extensions or OpenTelemetry). Important: This is not the name of the host entity, which can be modified based on naming rules. ⁸ Tags: `permission`	`ip-10-178-54-32.ec2.internal`
`service.name`	string	resource stable Display name: `OTel service name` The logical name of the service. ⁹	`shoppingcart`
`telemetry.exporter.name`	string	resource experimental Display name: `Telemetry exporter name` The exporter name. ¹⁰	`odin`
`telemetry.exporter.version`	string	resource experimental Display name: `Telemetry exporter version` The full agent/exporter version. ¹¹	`1.285.1.20240101-256988`

Always 'snowflake' for all Dynatrace Snowflake Observability Agent telemetry.

User-configured deployment environment label, for example, 'PROD', 'STG', or 'DEV'. Set via 'core.snowflake.deployment_environment'.

⁴

Optional user-defined tag for grouping Snowflake accounts in multitenancy mode, set via 'core.tag'.

⁵

Identifies the specific sub-context within the plugin (for example, 'query_history', 'users_all_roles').

⁶

Unique identifier for a single Dynatrace Snowflake Observability Agent execution run. Changes on every invocation.

⁷

The Dynatrace Snowflake Observability Agent plugin that produced this telemetry (for example, 'query_history', 'warehouse_usage').

⁸

The Snowflake account hostname (for example, 'xy12345.snowflakecomputing.com'), from 'core.snowflake.host_name'.

⁹

Always the Snowflake account identifier without '.snowflakecomputing.com' suffix (for example, 'myorg-myaccount').

¹⁰

Always 'dynatrace.snowagent' — identifies Dynatrace Snowflake Observability Agent as the telemetry exporter.

¹¹

The installed Dynatrace Snowflake Observability Agent version in <major>.<minor>.<patch>.<build> format.

db.system has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`adabas`	Adabas (Adaptable Database System)	Adabas
`amazon-documentdb`	Amazon DocumentDB	DocumentDB
`aurora-mysql`	Amazon Aurora MySQL	Aurora MySQL
`aurora-postgresql`	Amazon Aurora PostgreSQL	Aurora PostgreSQL
`cache`	InterSystems Caché	InterSystems Caché
`cassandra`	Apache Cassandra	Cassandra
`clickhouse`	ClickHouse	ClickHouse
`cloudscape`	Cloudscape	Cloudscape
`cockroachdb`	CockroachDB	CockroachDB
`coldfusion`	ColdFusion IMQ	ColdFusion IMQ
`cosmosdb`	Microsoft Azure Cosmos DB	Cosmos DB
`couchbase`	Couchbase	Couchbase
`couchdb`	CouchDB	CouchDB
`databricks`	Databricks Data Platform	Databricks Data Platform
`db2`	IBM Db2	IBM Db2
`derby`	Apache Derby	Derby
`dl/i`	IBM DL/I	IBM DL/I
`dynamodb`	Amazon DynamoDB	DynamoDB
`edb`	EnterpriseDB	EnterpriseDB
`elasticsearch`	Elasticsearch	Elasticsearch
`filemaker`	FileMaker	FileMaker
`firebird`	Firebird	Firebird
`firstsql`	FirstSQL	FirstSQL
`geode`	Apache Geode	Geode
`h2`	H2	H2
`hanadb`	SAP HANA	SAP HANA
`hbase`	Apache HBase	HBase
`hive`	Apache Hive	Hive
`hsqldb`	HyperSQL DataBase	HSQLDB
`informix`	Informix	Informix
`ingres`	Ingres	Ingres
`instantdb`	InstantDB	InstantDB
`interbase`	InterBase	InterBase
`keyspaces-cassandra`	Amazon Keyspaces for Apache Cassandra	Keyspaces
`mariadb`	MariaDB	MariaDB
`maxdb`	SAP MaxDB	SAP MaxDB
`memcached`	Memcached	Memcached
`mongodb`	MongoDB	MongoDB
`mssql`	Microsoft SQL Server	SQL Server
`mssqlcompact`	Microsoft SQL Server Compact	SQL Server Compact
`mysql`	MySQL	MySQL
`neo4j`	Neo4j	Neo4j
`neptune`	Amazon Neptune	Neptune
`netezza`	Netezza	Netezza
`opensearch`	OpenSearch	OpenSearch
`oracle`	Oracle Database	Oracle
`other_sql`	Some other SQL database. Fallback only. See notes.	Other SQL
`pervasive`	Pervasive PSQL	Pervasive PSQL
`phoenix`	Apache Phoenix	Apache Phoenix
`pointbase`	PointBase	PointBase
`postgresql`	PostgreSQL	PostgreSQL
`progress`	Progress Database	Progress
`redis`	Redis	Redis
`redshift`	Amazon Redshift	Redshift
`snowflake`	Snowflake Data Platform	Snowflake Data Platform
`spanner`	Cloud Spanner	Cloud Spanner
`sqlite`	SQLite	SQLite
`sybase`	Sybase	Sybase
`teradata`	Teradata	Teradata
`valkey`	Valkey	Valkey
`vertica`	Vertica	Vertica

Active queries log record fields

Attribute fields for active queries log records.

Attribute	Type	Description	Examples
`snowflake.error.code`	string	stable The error code returned by the operation, if any.	`1001`
`snowflake.error.message`	string	stable The error message returned by the operation, if any.	`Syntax error in SQL statement`
`snowflake.query.hash`	string	stable The hash of the query text.	`hash_abcdef`
`snowflake.query.hash_version`	long	experimental The version of the query hash logic.	`1`
`snowflake.query.id`	string	stable The unique identifier for the SQL query.	`b1bbaa7f-8144-4e50-947a-b7e9bf7d62d5`
`snowflake.query.parametrized_hash`	string	stable The hash value of the parameterized query text.	`param_hash_abcdef`
`snowflake.query.parametrized_hash_version`	long	experimental The version of the parameterized query hash logic.	`1`
`snowflake.query.tag`	string	stable The query tag associated with the operation, if any.	`daily_report`
`snowflake.schema.name`	string	stable The name of the schema.	`public`
`snowflake.session.id`	string	experimental The unique identifier for the session in which the query was executed. ¹	`123456789`

OTel semconv Development-tier attribute (session namespace). The semdict session.id is model-scoped/internal in code_monitoring only; no global ref available. Emitting as new id: pending global semdict registration.

Snowflake budgets log records

Log records emitted by the Dynatrace Snowflake Observability Agent budgets plugin.

Query

Fetch the 100 most recent Dynatrace Snowflake Observability Agent budgets plugin log entries from Grail.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "budgets"
| sort timestamp desc
| limit 100

Inspect the latest spend and limit readings for each Snowflake budget.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "budgets"
| filter isNotNull(snowflake.budget.name)
| fields timestamp, snowflake.budget.name, snowflake.credits.spent, snowflake.credits.limit
| sort timestamp desc
| limit 50

Rank Snowflake budgets by their most recent credits-spent reading.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "budgets"
| filter isNotNull(snowflake.budget.name)
| summarize { latest_spent = takeMax(toDouble(snowflake.credits.spent)) }, by: { snowflake.budget.name }
| sort latest_spent desc

Dynatrace Snowflake Observability Agent resource fields

Fields present on all Dynatrace Snowflake Observability Agent telemetry records. Synced with config.py RESOURCE_ATTRIBUTES.

Attribute	Type	Description	Examples
`db.system`	string	experimental Display name: `Database system` An identifier for the database management system (DBMS) product being used. See below for a list of well-known identifiers. ¹	`mongodb`; `mysql`
`deployment.environment`	string	resource deprecatedUse deployment.environment.name instead. Deprecated alias for deployment.environment.name. The deployment environment, for example, production, staging, or development. Will be removed in release 1.3.0. ²	`PROD`
`deployment.environment.name`	string	resource stable The deployment environment name (OTel semconv canonical field), for example, production, staging, or development. Emitted alongside deployment.environment during the deprecation window. ³	`PROD`
`deployment.environment.tag`	string	resource stable Optional tag for the deployment environment in multitenancy mode ⁴	`SA080`
`dsoa.run.context`	string	resource stable The name of the Dynatrace Snowflake Observability Agent context (part of plugin) used to produce the telemetry (logs, traces, metrics, or events). In case of multiple contexts within the same plugin, this helps differentiate between them. If plugin delivers only one context, this field will have the same value as the plugin name. ⁵	`users_all_roles`
`dsoa.run.id`	string	resource stable Unique ID of each execution of the Dynatrace Snowflake Observability Agent plugin. It can be used to differentiate between telemetry produced between two executions, for example, to calculate the change in the system. ⁶	`4aa7c76c-e98c-4b8b-a5b3-a8a721bbde2d`
`dsoa.run.plugin`	string	resource stable The name of the Dynatrace Snowflake Observability Agent plugin that produced this telemetry. Use to filter all telemetry from a specific plugin (for example, 'query_history', 'warehouse_usage'). Distinct from dsoa.run.context, which may represent a sub-context within a plugin. ⁷	`users`
`host.name`	string	resource experimental Display name: `Host name` The host name as determined on the data source (for instance, OneAgent, extensions or OpenTelemetry). Important: This is not the name of the host entity, which can be modified based on naming rules. ⁸ Tags: `permission`	`ip-10-178-54-32.ec2.internal`
`service.name`	string	resource stable Display name: `OTel service name` The logical name of the service. ⁹	`shoppingcart`
`telemetry.exporter.name`	string	resource experimental Display name: `Telemetry exporter name` The exporter name. ¹⁰	`odin`
`telemetry.exporter.version`	string	resource experimental Display name: `Telemetry exporter version` The full agent/exporter version. ¹¹	`1.285.1.20240101-256988`

Always 'snowflake' for all Dynatrace Snowflake Observability Agent telemetry.

User-configured deployment environment label, for example, 'PROD', 'STG', or 'DEV'. Set via 'core.snowflake.deployment_environment'.

⁴

Optional user-defined tag for grouping Snowflake accounts in multitenancy mode, set via 'core.tag'.

⁵

Identifies the specific sub-context within the plugin (for example, 'query_history', 'users_all_roles').

⁶

Unique identifier for a single Dynatrace Snowflake Observability Agent execution run. Changes on every invocation.

⁷

The Dynatrace Snowflake Observability Agent plugin that produced this telemetry (for example, 'query_history', 'warehouse_usage').

⁸

The Snowflake account hostname (for example, 'xy12345.snowflakecomputing.com'), from 'core.snowflake.host_name'.

⁹

Always the Snowflake account identifier without '.snowflakecomputing.com' suffix (for example, 'myorg-myaccount').

¹⁰

Always 'dynatrace.snowagent' — identifies Dynatrace Snowflake Observability Agent as the telemetry exporter.

¹¹

The installed Dynatrace Snowflake Observability Agent version in <major>.<minor>.<patch>.<build> format.

db.system has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`adabas`	Adabas (Adaptable Database System)	Adabas
`amazon-documentdb`	Amazon DocumentDB	DocumentDB
`aurora-mysql`	Amazon Aurora MySQL	Aurora MySQL
`aurora-postgresql`	Amazon Aurora PostgreSQL	Aurora PostgreSQL
`cache`	InterSystems Caché	InterSystems Caché
`cassandra`	Apache Cassandra	Cassandra
`clickhouse`	ClickHouse	ClickHouse
`cloudscape`	Cloudscape	Cloudscape
`cockroachdb`	CockroachDB	CockroachDB
`coldfusion`	ColdFusion IMQ	ColdFusion IMQ
`cosmosdb`	Microsoft Azure Cosmos DB	Cosmos DB
`couchbase`	Couchbase	Couchbase
`couchdb`	CouchDB	CouchDB
`databricks`	Databricks Data Platform	Databricks Data Platform
`db2`	IBM Db2	IBM Db2
`derby`	Apache Derby	Derby
`dl/i`	IBM DL/I	IBM DL/I
`dynamodb`	Amazon DynamoDB	DynamoDB
`edb`	EnterpriseDB	EnterpriseDB
`elasticsearch`	Elasticsearch	Elasticsearch
`filemaker`	FileMaker	FileMaker
`firebird`	Firebird	Firebird
`firstsql`	FirstSQL	FirstSQL
`geode`	Apache Geode	Geode
`h2`	H2	H2
`hanadb`	SAP HANA	SAP HANA
`hbase`	Apache HBase	HBase
`hive`	Apache Hive	Hive
`hsqldb`	HyperSQL DataBase	HSQLDB
`informix`	Informix	Informix
`ingres`	Ingres	Ingres
`instantdb`	InstantDB	InstantDB
`interbase`	InterBase	InterBase
`keyspaces-cassandra`	Amazon Keyspaces for Apache Cassandra	Keyspaces
`mariadb`	MariaDB	MariaDB
`maxdb`	SAP MaxDB	SAP MaxDB
`memcached`	Memcached	Memcached
`mongodb`	MongoDB	MongoDB
`mssql`	Microsoft SQL Server	SQL Server
`mssqlcompact`	Microsoft SQL Server Compact	SQL Server Compact
`mysql`	MySQL	MySQL
`neo4j`	Neo4j	Neo4j
`neptune`	Amazon Neptune	Neptune
`netezza`	Netezza	Netezza
`opensearch`	OpenSearch	OpenSearch
`oracle`	Oracle Database	Oracle
`other_sql`	Some other SQL database. Fallback only. See notes.	Other SQL
`pervasive`	Pervasive PSQL	Pervasive PSQL
`phoenix`	Apache Phoenix	Apache Phoenix
`pointbase`	PointBase	PointBase
`postgresql`	PostgreSQL	PostgreSQL
`progress`	Progress Database	Progress
`redis`	Redis	Redis
`redshift`	Amazon Redshift	Redshift
`snowflake`	Snowflake Data Platform	Snowflake Data Platform
`spanner`	Cloud Spanner	Cloud Spanner
`sqlite`	SQLite	SQLite
`sybase`	Sybase	Sybase
`teradata`	Teradata	Teradata
`valkey`	Valkey	Valkey
`vertica`	Vertica	Vertica

Budgets log record fields

Attribute fields for budgets log records.

Attribute	Type	Description	Examples
`snowflake.budget.owner.name`	string	stable The owner of the budget, typically the user or role responsible for managing the budget.	`budget_admin`
`snowflake.budget.owner.role_type`	string	experimental The principal type of the budget owner: ROLE or APPLICATION.	`ROLE`
`snowflake.budget.resource`	string[]	stable The resources linked to the budget, such as databases, warehouses, or other Snowflake objects that the budget monitors. ¹	`['DATABASE1', 'WAREHOUSE1']`

Array of resource names (databases, warehouses) in this budget group, stored as string[] in Grail.

Snowflake cold tables log records

Log records emitted by the Dynatrace Snowflake Observability Agent cold_tables plugin.

Query

Fetch the 100 most recent Dynatrace Snowflake Observability Agent cold_tables plugin log entries from Grail.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "cold_tables"
| sort timestamp desc
| limit 100

Fetch the 50 most recent tables classified as COLD by the cold_tables plugin.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "cold_tables"
| filter snowflake.table.cold_status == "COLD"
| sort timestamp desc
| limit 50

Rank Snowflake tables by how long they have been idle.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "cold_tables"
| filter isNotNull(snowflake.table.full_name)
| summarize { idle_days = takeMax(toLong(snowflake.table.days_since_last_access)) }, by: { snowflake.table.full_name }
| sort idle_days desc
| limit 25

Dynatrace Snowflake Observability Agent resource fields

Fields present on all Dynatrace Snowflake Observability Agent telemetry records. Synced with config.py RESOURCE_ATTRIBUTES.

Attribute	Type	Description	Examples
`db.system`	string	experimental Display name: `Database system` An identifier for the database management system (DBMS) product being used. See below for a list of well-known identifiers. ¹	`mongodb`; `mysql`
`deployment.environment`	string	resource deprecatedUse deployment.environment.name instead. Deprecated alias for deployment.environment.name. The deployment environment, for example, production, staging, or development. Will be removed in release 1.3.0. ²	`PROD`
`deployment.environment.name`	string	resource stable The deployment environment name (OTel semconv canonical field), for example, production, staging, or development. Emitted alongside deployment.environment during the deprecation window. ³	`PROD`
`deployment.environment.tag`	string	resource stable Optional tag for the deployment environment in multitenancy mode ⁴	`SA080`
`dsoa.run.context`	string	resource stable The name of the Dynatrace Snowflake Observability Agent context (part of plugin) used to produce the telemetry (logs, traces, metrics, or events). In case of multiple contexts within the same plugin, this helps differentiate between them. If plugin delivers only one context, this field will have the same value as the plugin name. ⁵	`users_all_roles`
`dsoa.run.id`	string	resource stable Unique ID of each execution of the Dynatrace Snowflake Observability Agent plugin. It can be used to differentiate between telemetry produced between two executions, for example, to calculate the change in the system. ⁶	`4aa7c76c-e98c-4b8b-a5b3-a8a721bbde2d`
`dsoa.run.plugin`	string	resource stable The name of the Dynatrace Snowflake Observability Agent plugin that produced this telemetry. Use to filter all telemetry from a specific plugin (for example, 'query_history', 'warehouse_usage'). Distinct from dsoa.run.context, which may represent a sub-context within a plugin. ⁷	`users`
`host.name`	string	resource experimental Display name: `Host name` The host name as determined on the data source (for instance, OneAgent, extensions or OpenTelemetry). Important: This is not the name of the host entity, which can be modified based on naming rules. ⁸ Tags: `permission`	`ip-10-178-54-32.ec2.internal`
`service.name`	string	resource stable Display name: `OTel service name` The logical name of the service. ⁹	`shoppingcart`
`telemetry.exporter.name`	string	resource experimental Display name: `Telemetry exporter name` The exporter name. ¹⁰	`odin`
`telemetry.exporter.version`	string	resource experimental Display name: `Telemetry exporter version` The full agent/exporter version. ¹¹	`1.285.1.20240101-256988`

Always 'snowflake' for all Dynatrace Snowflake Observability Agent telemetry.

User-configured deployment environment label, for example, 'PROD', 'STG', or 'DEV'. Set via 'core.snowflake.deployment_environment'.

⁴

Optional user-defined tag for grouping Snowflake accounts in multitenancy mode, set via 'core.tag'.

⁵

Identifies the specific sub-context within the plugin (for example, 'query_history', 'users_all_roles').

⁶

Unique identifier for a single Dynatrace Snowflake Observability Agent execution run. Changes on every invocation.

⁷

The Dynatrace Snowflake Observability Agent plugin that produced this telemetry (for example, 'query_history', 'warehouse_usage').

⁸

The Snowflake account hostname (for example, 'xy12345.snowflakecomputing.com'), from 'core.snowflake.host_name'.

⁹

Always the Snowflake account identifier without '.snowflakecomputing.com' suffix (for example, 'myorg-myaccount').

¹⁰

Always 'dynatrace.snowagent' — identifies Dynatrace Snowflake Observability Agent as the telemetry exporter.

¹¹

The installed Dynatrace Snowflake Observability Agent version in <major>.<minor>.<patch>.<build> format.

db.system has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`adabas`	Adabas (Adaptable Database System)	Adabas
`amazon-documentdb`	Amazon DocumentDB	DocumentDB
`aurora-mysql`	Amazon Aurora MySQL	Aurora MySQL
`aurora-postgresql`	Amazon Aurora PostgreSQL	Aurora PostgreSQL
`cache`	InterSystems Caché	InterSystems Caché
`cassandra`	Apache Cassandra	Cassandra
`clickhouse`	ClickHouse	ClickHouse
`cloudscape`	Cloudscape	Cloudscape
`cockroachdb`	CockroachDB	CockroachDB
`coldfusion`	ColdFusion IMQ	ColdFusion IMQ
`cosmosdb`	Microsoft Azure Cosmos DB	Cosmos DB
`couchbase`	Couchbase	Couchbase
`couchdb`	CouchDB	CouchDB
`databricks`	Databricks Data Platform	Databricks Data Platform
`db2`	IBM Db2	IBM Db2
`derby`	Apache Derby	Derby
`dl/i`	IBM DL/I	IBM DL/I
`dynamodb`	Amazon DynamoDB	DynamoDB
`edb`	EnterpriseDB	EnterpriseDB
`elasticsearch`	Elasticsearch	Elasticsearch
`filemaker`	FileMaker	FileMaker
`firebird`	Firebird	Firebird
`firstsql`	FirstSQL	FirstSQL
`geode`	Apache Geode	Geode
`h2`	H2	H2
`hanadb`	SAP HANA	SAP HANA
`hbase`	Apache HBase	HBase
`hive`	Apache Hive	Hive
`hsqldb`	HyperSQL DataBase	HSQLDB
`informix`	Informix	Informix
`ingres`	Ingres	Ingres
`instantdb`	InstantDB	InstantDB
`interbase`	InterBase	InterBase
`keyspaces-cassandra`	Amazon Keyspaces for Apache Cassandra	Keyspaces
`mariadb`	MariaDB	MariaDB
`maxdb`	SAP MaxDB	SAP MaxDB
`memcached`	Memcached	Memcached
`mongodb`	MongoDB	MongoDB
`mssql`	Microsoft SQL Server	SQL Server
`mssqlcompact`	Microsoft SQL Server Compact	SQL Server Compact
`mysql`	MySQL	MySQL
`neo4j`	Neo4j	Neo4j
`neptune`	Amazon Neptune	Neptune
`netezza`	Netezza	Netezza
`opensearch`	OpenSearch	OpenSearch
`oracle`	Oracle Database	Oracle
`other_sql`	Some other SQL database. Fallback only. See notes.	Other SQL
`pervasive`	Pervasive PSQL	Pervasive PSQL
`phoenix`	Apache Phoenix	Apache Phoenix
`pointbase`	PointBase	PointBase
`postgresql`	PostgreSQL	PostgreSQL
`progress`	Progress Database	Progress
`redis`	Redis	Redis
`redshift`	Amazon Redshift	Redshift
`snowflake`	Snowflake Data Platform	Snowflake Data Platform
`spanner`	Cloud Spanner	Cloud Spanner
`sqlite`	SQLite	SQLite
`sybase`	Sybase	Sybase
`teradata`	Teradata	Teradata
`valkey`	Valkey	Valkey
`vertica`	Vertica	Vertica

Cold tables log record fields

Attribute fields for cold tables log records.

Attribute	Type	Description	Examples
`snowflake.table.last_accessed_at`	string	experimental ISO 8601 timestamp of the most recent query that accessed this table.	`2026-01-15T10:30:00Z`

Snowflake data schemas log records

Log records emitted by the Dynatrace Snowflake Observability Agent data_schemas plugin.

Query

Fetch the 100 most recent Dynatrace Snowflake Observability Agent data_schemas plugin log entries (DDL change inventory) from Grail.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "data_schemas"
| sort timestamp desc
| limit 100

Fetch the 50 most recent DROP DDL operations reported by the data_schemas plugin.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "data_schemas"
| filter snowflake.object.ddl.operation == "DROP"
| sort timestamp desc
| limit 50

Fetch the 50 most recent DDL changes affecting Snowflake tables.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "data_schemas"
| filter snowflake.object.type == "Table"
| sort timestamp desc
| limit 50

Dynatrace Snowflake Observability Agent resource fields

Fields present on all Dynatrace Snowflake Observability Agent telemetry records. Synced with config.py RESOURCE_ATTRIBUTES.

Attribute	Type	Description	Examples
`db.system`	string	experimental Display name: `Database system` An identifier for the database management system (DBMS) product being used. See below for a list of well-known identifiers. ¹	`mongodb`; `mysql`
`deployment.environment`	string	resource deprecatedUse deployment.environment.name instead. Deprecated alias for deployment.environment.name. The deployment environment, for example, production, staging, or development. Will be removed in release 1.3.0. ²	`PROD`
`deployment.environment.name`	string	resource stable The deployment environment name (OTel semconv canonical field), for example, production, staging, or development. Emitted alongside deployment.environment during the deprecation window. ³	`PROD`
`deployment.environment.tag`	string	resource stable Optional tag for the deployment environment in multitenancy mode ⁴	`SA080`
`dsoa.run.context`	string	resource stable The name of the Dynatrace Snowflake Observability Agent context (part of plugin) used to produce the telemetry (logs, traces, metrics, or events). In case of multiple contexts within the same plugin, this helps differentiate between them. If plugin delivers only one context, this field will have the same value as the plugin name. ⁵	`users_all_roles`
`dsoa.run.id`	string	resource stable Unique ID of each execution of the Dynatrace Snowflake Observability Agent plugin. It can be used to differentiate between telemetry produced between two executions, for example, to calculate the change in the system. ⁶	`4aa7c76c-e98c-4b8b-a5b3-a8a721bbde2d`
`dsoa.run.plugin`	string	resource stable The name of the Dynatrace Snowflake Observability Agent plugin that produced this telemetry. Use to filter all telemetry from a specific plugin (for example, 'query_history', 'warehouse_usage'). Distinct from dsoa.run.context, which may represent a sub-context within a plugin. ⁷	`users`
`host.name`	string	resource experimental Display name: `Host name` The host name as determined on the data source (for instance, OneAgent, extensions or OpenTelemetry). Important: This is not the name of the host entity, which can be modified based on naming rules. ⁸ Tags: `permission`	`ip-10-178-54-32.ec2.internal`
`service.name`	string	resource stable Display name: `OTel service name` The logical name of the service. ⁹	`shoppingcart`
`telemetry.exporter.name`	string	resource experimental Display name: `Telemetry exporter name` The exporter name. ¹⁰	`odin`
`telemetry.exporter.version`	string	resource experimental Display name: `Telemetry exporter version` The full agent/exporter version. ¹¹	`1.285.1.20240101-256988`

Always 'snowflake' for all Dynatrace Snowflake Observability Agent telemetry.

User-configured deployment environment label, for example, 'PROD', 'STG', or 'DEV'. Set via 'core.snowflake.deployment_environment'.

⁴

Optional user-defined tag for grouping Snowflake accounts in multitenancy mode, set via 'core.tag'.

⁵

Identifies the specific sub-context within the plugin (for example, 'query_history', 'users_all_roles').

⁶

Unique identifier for a single Dynatrace Snowflake Observability Agent execution run. Changes on every invocation.

⁷

The Dynatrace Snowflake Observability Agent plugin that produced this telemetry (for example, 'query_history', 'warehouse_usage').

⁸

The Snowflake account hostname (for example, 'xy12345.snowflakecomputing.com'), from 'core.snowflake.host_name'.

⁹

Always the Snowflake account identifier without '.snowflakecomputing.com' suffix (for example, 'myorg-myaccount').

¹⁰

Always 'dynatrace.snowagent' — identifies Dynatrace Snowflake Observability Agent as the telemetry exporter.

¹¹

The installed Dynatrace Snowflake Observability Agent version in <major>.<minor>.<patch>.<build> format.

db.system has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`adabas`	Adabas (Adaptable Database System)	Adabas
`amazon-documentdb`	Amazon DocumentDB	DocumentDB
`aurora-mysql`	Amazon Aurora MySQL	Aurora MySQL
`aurora-postgresql`	Amazon Aurora PostgreSQL	Aurora PostgreSQL
`cache`	InterSystems Caché	InterSystems Caché
`cassandra`	Apache Cassandra	Cassandra
`clickhouse`	ClickHouse	ClickHouse
`cloudscape`	Cloudscape	Cloudscape
`cockroachdb`	CockroachDB	CockroachDB
`coldfusion`	ColdFusion IMQ	ColdFusion IMQ
`cosmosdb`	Microsoft Azure Cosmos DB	Cosmos DB
`couchbase`	Couchbase	Couchbase
`couchdb`	CouchDB	CouchDB
`databricks`	Databricks Data Platform	Databricks Data Platform
`db2`	IBM Db2	IBM Db2
`derby`	Apache Derby	Derby
`dl/i`	IBM DL/I	IBM DL/I
`dynamodb`	Amazon DynamoDB	DynamoDB
`edb`	EnterpriseDB	EnterpriseDB
`elasticsearch`	Elasticsearch	Elasticsearch
`filemaker`	FileMaker	FileMaker
`firebird`	Firebird	Firebird
`firstsql`	FirstSQL	FirstSQL
`geode`	Apache Geode	Geode
`h2`	H2	H2
`hanadb`	SAP HANA	SAP HANA
`hbase`	Apache HBase	HBase
`hive`	Apache Hive	Hive
`hsqldb`	HyperSQL DataBase	HSQLDB
`informix`	Informix	Informix
`ingres`	Ingres	Ingres
`instantdb`	InstantDB	InstantDB
`interbase`	InterBase	InterBase
`keyspaces-cassandra`	Amazon Keyspaces for Apache Cassandra	Keyspaces
`mariadb`	MariaDB	MariaDB
`maxdb`	SAP MaxDB	SAP MaxDB
`memcached`	Memcached	Memcached
`mongodb`	MongoDB	MongoDB
`mssql`	Microsoft SQL Server	SQL Server
`mssqlcompact`	Microsoft SQL Server Compact	SQL Server Compact
`mysql`	MySQL	MySQL
`neo4j`	Neo4j	Neo4j
`neptune`	Amazon Neptune	Neptune
`netezza`	Netezza	Netezza
`opensearch`	OpenSearch	OpenSearch
`oracle`	Oracle Database	Oracle
`other_sql`	Some other SQL database. Fallback only. See notes.	Other SQL
`pervasive`	Pervasive PSQL	Pervasive PSQL
`phoenix`	Apache Phoenix	Apache Phoenix
`pointbase`	PointBase	PointBase
`postgresql`	PostgreSQL	PostgreSQL
`progress`	Progress Database	Progress
`redis`	Redis	Redis
`redshift`	Amazon Redshift	Redshift
`snowflake`	Snowflake Data Platform	Snowflake Data Platform
`spanner`	Cloud Spanner	Cloud Spanner
`sqlite`	SQLite	SQLite
`sybase`	Sybase	Sybase
`teradata`	Teradata	Teradata
`valkey`	Valkey	Valkey
`vertica`	Vertica	Vertica

Data schemas log record fields

Attribute fields for data schemas log records.

Attribute	Type	Description	Examples
`snowflake.object.ddl.modified`	string	experimental A JSON array that specifies the objects that were associated with a write operation in the query. ¹	`{ "DTAGENT_DB.APP.TMP_RECENT_QUERIES": { "objectColumns": "HISTOGRAM_METRICS, COUNTER_METRICS, START_TIME, STATUS_CODE, SESSION_ID, QUERY_ID, DIMENSIONS, END_TIME, NAME, ATTRIBUTES, PARENT_QUERY_ID", "objectDomain": "Table" } }`
`snowflake.object.ddl.operation`	string	stable The SQL keyword that specifies the operation on the table, view, or column.	`REPLACE`
`snowflake.object.ddl.properties`	string	stable A JSON array that specifies the object or column properties when you create, modify, drop, or undrop the object or column. There are two types of properties: atomic and compound. ²	`{"creationMode": "CREATE", "columns": {"ADD": ["ATTRIBUTE","JOB_ID"]}}`
`snowflake.object.id`	long	stable An identifier for the object, which is unique within a given account and domain.	`747545`
`snowflake.object.name`	string	stable The fully qualified name of the object defined or modified by the DDL operation.	`DTAGENT_DB.APP.TMP_RECENT_QUERIES`
`snowflake.object.type`	string	stable The domain of the object defined or modified by the DDL operation.	`Table`
`snowflake.query.parent_id`	string	stable The query ID of the parent job or NULL if the job does not have a parent.	`01b2fd01-0604-6864-0040-e003029abda2`
`snowflake.query.root_id`	string	experimental The query ID of the top most job in the chain or NULL if the job does not have a parent.	`01b2fd00-0604-6864-0040-e003029abd82`

Serialized JSON object stored as string in Grail. Contains modified DDL object details. Parse with parseJson() in DQL.

Stored as a serialized JSON string, not plain text.

Snowflake dynamic tables log records

Log records emitted by the Dynatrace Snowflake Observability Agent dynamic_tables plugin.

Query

Fetch the 100 most recent Dynatrace Snowflake Observability Agent dynamic_tables plugin log entries from Grail.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "dynamic_tables"
| sort timestamp desc
| limit 100

Fetch dynamic table refreshes that missed their target lag (within-ratio below 1.0).

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "dynamic_tables"
| filter toDouble(snowflake.table.dynamic.lag.target.within_ratio) < 1.0
| sort timestamp desc
| limit 50

Rank dynamic tables by their maximum observed refresh lag.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "dynamic_tables"
| filter isNotNull(snowflake.table.full_name)
| summarize { max_lag = takeMax(toLong(snowflake.table.dynamic.lag.max)) }, by: { snowflake.table.full_name }
| sort max_lag desc
| limit 25

Dynatrace Snowflake Observability Agent resource fields

Fields present on all Dynatrace Snowflake Observability Agent telemetry records. Synced with config.py RESOURCE_ATTRIBUTES.

Attribute	Type	Description	Examples
`db.system`	string	experimental Display name: `Database system` An identifier for the database management system (DBMS) product being used. See below for a list of well-known identifiers. ¹	`mongodb`; `mysql`
`deployment.environment`	string	resource deprecatedUse deployment.environment.name instead. Deprecated alias for deployment.environment.name. The deployment environment, for example, production, staging, or development. Will be removed in release 1.3.0. ²	`PROD`
`deployment.environment.name`	string	resource stable The deployment environment name (OTel semconv canonical field), for example, production, staging, or development. Emitted alongside deployment.environment during the deprecation window. ³	`PROD`
`deployment.environment.tag`	string	resource stable Optional tag for the deployment environment in multitenancy mode ⁴	`SA080`
`dsoa.run.context`	string	resource stable The name of the Dynatrace Snowflake Observability Agent context (part of plugin) used to produce the telemetry (logs, traces, metrics, or events). In case of multiple contexts within the same plugin, this helps differentiate between them. If plugin delivers only one context, this field will have the same value as the plugin name. ⁵	`users_all_roles`
`dsoa.run.id`	string	resource stable Unique ID of each execution of the Dynatrace Snowflake Observability Agent plugin. It can be used to differentiate between telemetry produced between two executions, for example, to calculate the change in the system. ⁶	`4aa7c76c-e98c-4b8b-a5b3-a8a721bbde2d`
`dsoa.run.plugin`	string	resource stable The name of the Dynatrace Snowflake Observability Agent plugin that produced this telemetry. Use to filter all telemetry from a specific plugin (for example, 'query_history', 'warehouse_usage'). Distinct from dsoa.run.context, which may represent a sub-context within a plugin. ⁷	`users`
`host.name`	string	resource experimental Display name: `Host name` The host name as determined on the data source (for instance, OneAgent, extensions or OpenTelemetry). Important: This is not the name of the host entity, which can be modified based on naming rules. ⁸ Tags: `permission`	`ip-10-178-54-32.ec2.internal`
`service.name`	string	resource stable Display name: `OTel service name` The logical name of the service. ⁹	`shoppingcart`
`telemetry.exporter.name`	string	resource experimental Display name: `Telemetry exporter name` The exporter name. ¹⁰	`odin`
`telemetry.exporter.version`	string	resource experimental Display name: `Telemetry exporter version` The full agent/exporter version. ¹¹	`1.285.1.20240101-256988`

Always 'snowflake' for all Dynatrace Snowflake Observability Agent telemetry.

User-configured deployment environment label, for example, 'PROD', 'STG', or 'DEV'. Set via 'core.snowflake.deployment_environment'.

⁴

Optional user-defined tag for grouping Snowflake accounts in multitenancy mode, set via 'core.tag'.

⁵

Identifies the specific sub-context within the plugin (for example, 'query_history', 'users_all_roles').

⁶

Unique identifier for a single Dynatrace Snowflake Observability Agent execution run. Changes on every invocation.

⁷

The Dynatrace Snowflake Observability Agent plugin that produced this telemetry (for example, 'query_history', 'warehouse_usage').

⁸

The Snowflake account hostname (for example, 'xy12345.snowflakecomputing.com'), from 'core.snowflake.host_name'.

⁹

Always the Snowflake account identifier without '.snowflakecomputing.com' suffix (for example, 'myorg-myaccount').

¹⁰

Always 'dynatrace.snowagent' — identifies Dynatrace Snowflake Observability Agent as the telemetry exporter.

¹¹

The installed Dynatrace Snowflake Observability Agent version in <major>.<minor>.<patch>.<build> format.

db.system has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`adabas`	Adabas (Adaptable Database System)	Adabas
`amazon-documentdb`	Amazon DocumentDB	DocumentDB
`aurora-mysql`	Amazon Aurora MySQL	Aurora MySQL
`aurora-postgresql`	Amazon Aurora PostgreSQL	Aurora PostgreSQL
`cache`	InterSystems Caché	InterSystems Caché
`cassandra`	Apache Cassandra	Cassandra
`clickhouse`	ClickHouse	ClickHouse
`cloudscape`	Cloudscape	Cloudscape
`cockroachdb`	CockroachDB	CockroachDB
`coldfusion`	ColdFusion IMQ	ColdFusion IMQ
`cosmosdb`	Microsoft Azure Cosmos DB	Cosmos DB
`couchbase`	Couchbase	Couchbase
`couchdb`	CouchDB	CouchDB
`databricks`	Databricks Data Platform	Databricks Data Platform
`db2`	IBM Db2	IBM Db2
`derby`	Apache Derby	Derby
`dl/i`	IBM DL/I	IBM DL/I
`dynamodb`	Amazon DynamoDB	DynamoDB
`edb`	EnterpriseDB	EnterpriseDB
`elasticsearch`	Elasticsearch	Elasticsearch
`filemaker`	FileMaker	FileMaker
`firebird`	Firebird	Firebird
`firstsql`	FirstSQL	FirstSQL
`geode`	Apache Geode	Geode
`h2`	H2	H2
`hanadb`	SAP HANA	SAP HANA
`hbase`	Apache HBase	HBase
`hive`	Apache Hive	Hive
`hsqldb`	HyperSQL DataBase	HSQLDB
`informix`	Informix	Informix
`ingres`	Ingres	Ingres
`instantdb`	InstantDB	InstantDB
`interbase`	InterBase	InterBase
`keyspaces-cassandra`	Amazon Keyspaces for Apache Cassandra	Keyspaces
`mariadb`	MariaDB	MariaDB
`maxdb`	SAP MaxDB	SAP MaxDB
`memcached`	Memcached	Memcached
`mongodb`	MongoDB	MongoDB
`mssql`	Microsoft SQL Server	SQL Server
`mssqlcompact`	Microsoft SQL Server Compact	SQL Server Compact
`mysql`	MySQL	MySQL
`neo4j`	Neo4j	Neo4j
`neptune`	Amazon Neptune	Neptune
`netezza`	Netezza	Netezza
`opensearch`	OpenSearch	OpenSearch
`oracle`	Oracle Database	Oracle
`other_sql`	Some other SQL database. Fallback only. See notes.	Other SQL
`pervasive`	Pervasive PSQL	Pervasive PSQL
`phoenix`	Apache Phoenix	Apache Phoenix
`pointbase`	PointBase	PointBase
`postgresql`	PostgreSQL	PostgreSQL
`progress`	Progress Database	Progress
`redis`	Redis	Redis
`redshift`	Amazon Redshift	Redshift
`snowflake`	Snowflake Data Platform	Snowflake Data Platform
`spanner`	Cloud Spanner	Cloud Spanner
`sqlite`	SQLite	SQLite
`sybase`	Sybase	Sybase
`teradata`	Teradata	Teradata
`valkey`	Valkey	Valkey
`vertica`	Vertica	Vertica

Dynamic tables log record fields

Attribute fields for dynamic tables log records.

Attribute	Type	Description	Examples
`snowflake.table.dynamic.graph.alter_trigger`	string[]	experimental Describes why a new entry is created in the DYNAMIC_TABLE_GRAPH_HISTORY function. ¹	`['NONE']`; `['CREATE_DYNAMIC_TABLE']`; `['ALTER_TARGET_LAG']`; `['SUSPEND']`; `['RESUME']`; `['REPLICATION_REFRESH']`; `['ALTER_WAREHOUSE']`
`snowflake.table.dynamic.graph.inputs`	string[]	experimental Each OBJECT represents a table, view, or dynamic table that serves as the input to this dynamic table. ²	`['{"kind": "TABLE", "name": "DYNAMIC_TABLE_DB.DYNAMIC_TABLE_SCH.EMPLOYEE"}', '{"kind": "TABLE", "name": "DYNAMIC_TABLE_DB.DYNAMIC_TABLE_SCH.EMPLOYEE_SKILL"}']`
`snowflake.table.dynamic.graph.valid_to`	long	experimental If present, the description of the dynamic table is valid up to this time. If null, the description is still accurate.	`1733011200000000000`
`snowflake.table.dynamic.lag.target.type`	string	experimental The type of target lag.	`USER_DEFINED`
`snowflake.table.dynamic.latest.code`	string	experimental Code representing the current state of the refresh. If the LAST_COMPLETED_REFRESH_STATE is FAILED, this column shows the error code associated with the failure.	`SUCCESS`
`snowflake.table.dynamic.latest.data_timestamp`	string	experimental Data timestamp of the last successful refresh. ³	`2024-11-22 12:55:29.695 Z`
`snowflake.table.dynamic.latest.dependency.data_timestamp`	string	experimental Data timestamp of the latest dependency to become available. ⁴	`2024-11-25 06:09:53.695 Z`
`snowflake.table.dynamic.latest.dependency.name`	string	experimental Qualified name of the latest dependency to become available.	`DYNAMIC_TABLE_DB.DYNAMIC_TABLE_SCH.EMPLOYEE`
`snowflake.table.dynamic.latest.message`	string	experimental Description of the current state of the refresh. If the LAST_COMPLETED_REFRESH_STATE is FAILED, this column shows the error message associated with the failure.	`Refresh completed successfully`
`snowflake.table.dynamic.latest.state`	string	experimental Status of the last terminated refresh for the dynamic table.	`SUCCEEDED`
`snowflake.table.dynamic.refresh.action`	string	stable Describes the type of refresh action performed.	`NO_DATA`
`snowflake.table.dynamic.refresh.code`	string	stable Code representing the current state of the refresh.	`SUCCESS`
`snowflake.table.dynamic.refresh.completion_target`	long	experimental Time by which this refresh should complete to keep lag under the TARGET_LAG parameter for the dynamic table.	`1732515005695000000`
`snowflake.table.dynamic.refresh.data_timestamp`	long	experimental Transactional timestamp when the refresh was evaluated.	`1732514993695000000`
`snowflake.table.dynamic.refresh.end`	long	experimental Time when the refresh completed.	`1732514995308000000`
`snowflake.table.dynamic.refresh.message`	string	stable Description of the current state of the refresh.	`Refresh completed successfully`
`snowflake.table.dynamic.refresh.start`	long	experimental Time when the refresh job started.	`1732514994978000000`
`snowflake.table.dynamic.refresh.state`	string	stable Status of the refresh for the dynamic table.	`SUCCEEDED`
`snowflake.table.dynamic.refresh.trigger`	string	stable Describes the trigger for the refresh.	`SCHEDULED`
`snowflake.table.dynamic.scheduling.reason.code`	string	experimental Optional reason code if the state is not ACTIVE.	`MAINTENANCE`
`snowflake.table.dynamic.scheduling.reason.message`	string	experimental Text description of the reason the dynamic table is not active. Only applies if the state is not active.	`Scheduled maintenance`
`snowflake.table.dynamic.scheduling.state`	string	stable Scheduling state of the dynamic table.	`ACTIVE`

Array of DDL operation names stored as string[] in Grail (for example, CREATE_DYNAMIC_TABLE).

Array of input table references stored as string[] in Grail. Each element is a JSON-serialized object with kind and name fields.

ISO 8601 timestamp string stored as string in Grail.

⁴

ISO 8601 timestamp string stored as string in Grail.

Log records emitted by the Dynatrace Snowflake Observability Agent login_history plugin.

Query

Fetch the 100 most recent Dynatrace Snowflake Observability Agent login_history plugin log entries from Grail.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "login_history"
| sort timestamp desc
| limit 100

Fetch failed Snowflake logins with their authentication type and error details.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "login_history"
| filter isNotNull(snowflake.error.code)
| fields timestamp, db.user, authentication.type, snowflake.error.code, snowflake.status.message
| sort timestamp desc
| limit 50

Rank source IP and user combinations by Snowflake login attempt volume.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "login_history"
| filter isNotNull(client.ip)
| summarize { attempts = count() }, by: { client.ip, db.user }
| sort attempts desc
| limit 25

Dynatrace Snowflake Observability Agent resource fields

Fields present on all Dynatrace Snowflake Observability Agent telemetry records. Synced with config.py RESOURCE_ATTRIBUTES.

Attribute	Type	Description	Examples
`db.system`	string	experimental Display name: `Database system` An identifier for the database management system (DBMS) product being used. See below for a list of well-known identifiers. ¹	`mongodb`; `mysql`
`deployment.environment`	string	resource deprecatedUse deployment.environment.name instead. Deprecated alias for deployment.environment.name. The deployment environment, for example, production, staging, or development. Will be removed in release 1.3.0. ²	`PROD`
`deployment.environment.name`	string	resource stable The deployment environment name (OTel semconv canonical field), for example, production, staging, or development. Emitted alongside deployment.environment during the deprecation window. ³	`PROD`
`deployment.environment.tag`	string	resource stable Optional tag for the deployment environment in multitenancy mode ⁴	`SA080`
`dsoa.run.context`	string	resource stable The name of the Dynatrace Snowflake Observability Agent context (part of plugin) used to produce the telemetry (logs, traces, metrics, or events). In case of multiple contexts within the same plugin, this helps differentiate between them. If plugin delivers only one context, this field will have the same value as the plugin name. ⁵	`users_all_roles`
`dsoa.run.id`	string	resource stable Unique ID of each execution of the Dynatrace Snowflake Observability Agent plugin. It can be used to differentiate between telemetry produced between two executions, for example, to calculate the change in the system. ⁶	`4aa7c76c-e98c-4b8b-a5b3-a8a721bbde2d`
`dsoa.run.plugin`	string	resource stable The name of the Dynatrace Snowflake Observability Agent plugin that produced this telemetry. Use to filter all telemetry from a specific plugin (for example, 'query_history', 'warehouse_usage'). Distinct from dsoa.run.context, which may represent a sub-context within a plugin. ⁷	`users`
`host.name`	string	resource experimental Display name: `Host name` The host name as determined on the data source (for instance, OneAgent, extensions or OpenTelemetry). Important: This is not the name of the host entity, which can be modified based on naming rules. ⁸ Tags: `permission`	`ip-10-178-54-32.ec2.internal`
`service.name`	string	resource stable Display name: `OTel service name` The logical name of the service. ⁹	`shoppingcart`
`telemetry.exporter.name`	string	resource experimental Display name: `Telemetry exporter name` The exporter name. ¹⁰	`odin`
`telemetry.exporter.version`	string	resource experimental Display name: `Telemetry exporter version` The full agent/exporter version. ¹¹	`1.285.1.20240101-256988`

Always 'snowflake' for all Dynatrace Snowflake Observability Agent telemetry.

User-configured deployment environment label, for example, 'PROD', 'STG', or 'DEV'. Set via 'core.snowflake.deployment_environment'.

⁴

Optional user-defined tag for grouping Snowflake accounts in multitenancy mode, set via 'core.tag'.

⁵

Identifies the specific sub-context within the plugin (for example, 'query_history', 'users_all_roles').

⁶

Unique identifier for a single Dynatrace Snowflake Observability Agent execution run. Changes on every invocation.

⁷

The Dynatrace Snowflake Observability Agent plugin that produced this telemetry (for example, 'query_history', 'warehouse_usage').

⁸

The Snowflake account hostname (for example, 'xy12345.snowflakecomputing.com'), from 'core.snowflake.host_name'.

⁹

Always the Snowflake account identifier without '.snowflakecomputing.com' suffix (for example, 'myorg-myaccount').

¹⁰

Always 'dynatrace.snowagent' — identifies Dynatrace Snowflake Observability Agent as the telemetry exporter.

¹¹

The installed Dynatrace Snowflake Observability Agent version in <major>.<minor>.<patch>.<build> format.

db.system has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`adabas`	Adabas (Adaptable Database System)	Adabas
`amazon-documentdb`	Amazon DocumentDB	DocumentDB
`aurora-mysql`	Amazon Aurora MySQL	Aurora MySQL
`aurora-postgresql`	Amazon Aurora PostgreSQL	Aurora PostgreSQL
`cache`	InterSystems Caché	InterSystems Caché
`cassandra`	Apache Cassandra	Cassandra
`clickhouse`	ClickHouse	ClickHouse
`cloudscape`	Cloudscape	Cloudscape
`cockroachdb`	CockroachDB	CockroachDB
`coldfusion`	ColdFusion IMQ	ColdFusion IMQ
`cosmosdb`	Microsoft Azure Cosmos DB	Cosmos DB
`couchbase`	Couchbase	Couchbase
`couchdb`	CouchDB	CouchDB
`databricks`	Databricks Data Platform	Databricks Data Platform
`db2`	IBM Db2	IBM Db2
`derby`	Apache Derby	Derby
`dl/i`	IBM DL/I	IBM DL/I
`dynamodb`	Amazon DynamoDB	DynamoDB
`edb`	EnterpriseDB	EnterpriseDB
`elasticsearch`	Elasticsearch	Elasticsearch
`filemaker`	FileMaker	FileMaker
`firebird`	Firebird	Firebird
`firstsql`	FirstSQL	FirstSQL
`geode`	Apache Geode	Geode
`h2`	H2	H2
`hanadb`	SAP HANA	SAP HANA
`hbase`	Apache HBase	HBase
`hive`	Apache Hive	Hive
`hsqldb`	HyperSQL DataBase	HSQLDB
`informix`	Informix	Informix
`ingres`	Ingres	Ingres
`instantdb`	InstantDB	InstantDB
`interbase`	InterBase	InterBase
`keyspaces-cassandra`	Amazon Keyspaces for Apache Cassandra	Keyspaces
`mariadb`	MariaDB	MariaDB
`maxdb`	SAP MaxDB	SAP MaxDB
`memcached`	Memcached	Memcached
`mongodb`	MongoDB	MongoDB
`mssql`	Microsoft SQL Server	SQL Server
`mssqlcompact`	Microsoft SQL Server Compact	SQL Server Compact
`mysql`	MySQL	MySQL
`neo4j`	Neo4j	Neo4j
`neptune`	Amazon Neptune	Neptune
`netezza`	Netezza	Netezza
`opensearch`	OpenSearch	OpenSearch
`oracle`	Oracle Database	Oracle
`other_sql`	Some other SQL database. Fallback only. See notes.	Other SQL
`pervasive`	Pervasive PSQL	Pervasive PSQL
`phoenix`	Apache Phoenix	Apache Phoenix
`pointbase`	PointBase	PointBase
`postgresql`	PostgreSQL	PostgreSQL
`progress`	Progress Database	Progress
`redis`	Redis	Redis
`redshift`	Amazon Redshift	Redshift
`snowflake`	Snowflake Data Platform	Snowflake Data Platform
`spanner`	Cloud Spanner	Cloud Spanner
`sqlite`	SQLite	SQLite
`sybase`	Sybase	Sybase
`teradata`	Teradata	Teradata
`valkey`	Valkey	Valkey
`vertica`	Vertica	Vertica

Attribute fields for login history log records.

Attribute	Type	Description	Examples
`authentication.factor.first`	string	stable The first factor used for authentication, typically a password.	`PASSWORD`
`authentication.factor.second`	string	stable The second factor used for authentication, such as an MFA token. Omitted when only a single factor was used.	`TOTP`
`client.application.id`	string	stable The ID of the client application used for the session.	`SnowflakeJDBCDriver`
`client.application.version`	string	experimental The version of the client application used for the session.	`1.0.0`
`client.build_id`	string	experimental The build ID of the client application.	`build123`
`client.environment`	string	stable The environment of the client application.	`PRODUCTION`
`client.version`	string	experimental The version of the client software used to connect to Snowflake.	`1.0.0`
`db.snowflake.connection`	string	experimental The name of the connection used by the client, or NULL if the client is not using a connection URL.	`connection_1`
`event.related_id`	long	experimental An identifier for a related event, if applicable.	`987654321`
`snowflake.session.closed_reason`	string	experimental The reason the session was closed.	`USER_LOGOUT`
`snowflake.session.start`	long	experimental The start time of the session.	`1633046400000000000`
`snowflake.status.code`	string	experimental The status of the login attempt, indicating success (OK) or failure (ERROR).	`OK`
`snowflake.status.message`	string	experimental A human-readable message providing additional detail about the operation status.	`Login successful`

Snowflake metering log records

Log records emitted by the Dynatrace Snowflake Observability Agent metering plugin.

Query

Fetch the 100 most recent Dynatrace Snowflake Observability Agent metering plugin log entries from Grail.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "metering"
| sort timestamp desc
| limit 100

Inspect per-service credit consumption readings from the metering plugin.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "metering"
| filter isNotNull(snowflake.service.name)
| fields timestamp, snowflake.service.name, snowflake.service.type, snowflake.credits.used
| sort timestamp desc
| limit 50

Rank Snowflake services by total metered credit consumption.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "metering"
| filter isNotNull(snowflake.service.name)
| summarize { total_credits = sum(toDouble(snowflake.credits.used)) }, by: { snowflake.service.name }
| sort total_credits desc
| limit 25

Dynatrace Snowflake Observability Agent resource fields

Fields present on all Dynatrace Snowflake Observability Agent telemetry records. Synced with config.py RESOURCE_ATTRIBUTES.

Attribute	Type	Description	Examples
`db.system`	string	experimental Display name: `Database system` An identifier for the database management system (DBMS) product being used. See below for a list of well-known identifiers. ¹	`mongodb`; `mysql`
`deployment.environment`	string	resource deprecatedUse deployment.environment.name instead. Deprecated alias for deployment.environment.name. The deployment environment, for example, production, staging, or development. Will be removed in release 1.3.0. ²	`PROD`
`deployment.environment.name`	string	resource stable The deployment environment name (OTel semconv canonical field), for example, production, staging, or development. Emitted alongside deployment.environment during the deprecation window. ³	`PROD`
`deployment.environment.tag`	string	resource stable Optional tag for the deployment environment in multitenancy mode ⁴	`SA080`
`dsoa.run.context`	string	resource stable The name of the Dynatrace Snowflake Observability Agent context (part of plugin) used to produce the telemetry (logs, traces, metrics, or events). In case of multiple contexts within the same plugin, this helps differentiate between them. If plugin delivers only one context, this field will have the same value as the plugin name. ⁵	`users_all_roles`
`dsoa.run.id`	string	resource stable Unique ID of each execution of the Dynatrace Snowflake Observability Agent plugin. It can be used to differentiate between telemetry produced between two executions, for example, to calculate the change in the system. ⁶	`4aa7c76c-e98c-4b8b-a5b3-a8a721bbde2d`
`dsoa.run.plugin`	string	resource stable The name of the Dynatrace Snowflake Observability Agent plugin that produced this telemetry. Use to filter all telemetry from a specific plugin (for example, 'query_history', 'warehouse_usage'). Distinct from dsoa.run.context, which may represent a sub-context within a plugin. ⁷	`users`
`host.name`	string	resource experimental Display name: `Host name` The host name as determined on the data source (for instance, OneAgent, extensions or OpenTelemetry). Important: This is not the name of the host entity, which can be modified based on naming rules. ⁸ Tags: `permission`	`ip-10-178-54-32.ec2.internal`
`service.name`	string	resource stable Display name: `OTel service name` The logical name of the service. ⁹	`shoppingcart`
`telemetry.exporter.name`	string	resource experimental Display name: `Telemetry exporter name` The exporter name. ¹⁰	`odin`
`telemetry.exporter.version`	string	resource experimental Display name: `Telemetry exporter version` The full agent/exporter version. ¹¹	`1.285.1.20240101-256988`

Always 'snowflake' for all Dynatrace Snowflake Observability Agent telemetry.

User-configured deployment environment label, for example, 'PROD', 'STG', or 'DEV'. Set via 'core.snowflake.deployment_environment'.

⁴

Optional user-defined tag for grouping Snowflake accounts in multitenancy mode, set via 'core.tag'.

⁵

Identifies the specific sub-context within the plugin (for example, 'query_history', 'users_all_roles').

⁶

Unique identifier for a single Dynatrace Snowflake Observability Agent execution run. Changes on every invocation.

⁷

The Dynatrace Snowflake Observability Agent plugin that produced this telemetry (for example, 'query_history', 'warehouse_usage').

⁸

The Snowflake account hostname (for example, 'xy12345.snowflakecomputing.com'), from 'core.snowflake.host_name'.

⁹

Always the Snowflake account identifier without '.snowflakecomputing.com' suffix (for example, 'myorg-myaccount').

¹⁰

Always 'dynatrace.snowagent' — identifies Dynatrace Snowflake Observability Agent as the telemetry exporter.

¹¹

The installed Dynatrace Snowflake Observability Agent version in <major>.<minor>.<patch>.<build> format.

db.system has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`adabas`	Adabas (Adaptable Database System)	Adabas
`amazon-documentdb`	Amazon DocumentDB	DocumentDB
`aurora-mysql`	Amazon Aurora MySQL	Aurora MySQL
`aurora-postgresql`	Amazon Aurora PostgreSQL	Aurora PostgreSQL
`cache`	InterSystems Caché	InterSystems Caché
`cassandra`	Apache Cassandra	Cassandra
`clickhouse`	ClickHouse	ClickHouse
`cloudscape`	Cloudscape	Cloudscape
`cockroachdb`	CockroachDB	CockroachDB
`coldfusion`	ColdFusion IMQ	ColdFusion IMQ
`cosmosdb`	Microsoft Azure Cosmos DB	Cosmos DB
`couchbase`	Couchbase	Couchbase
`couchdb`	CouchDB	CouchDB
`databricks`	Databricks Data Platform	Databricks Data Platform
`db2`	IBM Db2	IBM Db2
`derby`	Apache Derby	Derby
`dl/i`	IBM DL/I	IBM DL/I
`dynamodb`	Amazon DynamoDB	DynamoDB
`edb`	EnterpriseDB	EnterpriseDB
`elasticsearch`	Elasticsearch	Elasticsearch
`filemaker`	FileMaker	FileMaker
`firebird`	Firebird	Firebird
`firstsql`	FirstSQL	FirstSQL
`geode`	Apache Geode	Geode
`h2`	H2	H2
`hanadb`	SAP HANA	SAP HANA
`hbase`	Apache HBase	HBase
`hive`	Apache Hive	Hive
`hsqldb`	HyperSQL DataBase	HSQLDB
`informix`	Informix	Informix
`ingres`	Ingres	Ingres
`instantdb`	InstantDB	InstantDB
`interbase`	InterBase	InterBase
`keyspaces-cassandra`	Amazon Keyspaces for Apache Cassandra	Keyspaces
`mariadb`	MariaDB	MariaDB
`maxdb`	SAP MaxDB	SAP MaxDB
`memcached`	Memcached	Memcached
`mongodb`	MongoDB	MongoDB
`mssql`	Microsoft SQL Server	SQL Server
`mssqlcompact`	Microsoft SQL Server Compact	SQL Server Compact
`mysql`	MySQL	MySQL
`neo4j`	Neo4j	Neo4j
`neptune`	Amazon Neptune	Neptune
`netezza`	Netezza	Netezza
`opensearch`	OpenSearch	OpenSearch
`oracle`	Oracle Database	Oracle
`other_sql`	Some other SQL database. Fallback only. See notes.	Other SQL
`pervasive`	Pervasive PSQL	Pervasive PSQL
`phoenix`	Apache Phoenix	Apache Phoenix
`pointbase`	PointBase	PointBase
`postgresql`	PostgreSQL	PostgreSQL
`progress`	Progress Database	Progress
`redis`	Redis	Redis
`redshift`	Amazon Redshift	Redshift
`snowflake`	Snowflake Data Platform	Snowflake Data Platform
`spanner`	Cloud Spanner	Cloud Spanner
`sqlite`	SQLite	SQLite
`sybase`	Sybase	Sybase
`teradata`	Teradata	Teradata
`valkey`	Valkey	Valkey
`vertica`	Vertica	Vertica

Metering log record fields

Attribute fields for metering log records.

Attribute	Type	Description	Examples
`snowflake.service.entity_id`	long	experimental Unique Snowflake identifier of the service entity.	`12345`

Snowflake organization costs log records

Log records emitted by the Dynatrace Snowflake Observability Agent org_costs plugin.

Query

Fetch the 100 most recent Dynatrace Snowflake Observability Agent org_costs plugin log entries from Grail.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "org_costs"
| sort timestamp desc
| limit 100

Inspect per-account organization credit and billing readings from the org_costs plugin.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "org_costs"
| filter isNotNull(snowflake.account.name)
| fields timestamp, snowflake.account.name, snowflake.org.credits.used, snowflake.org.billing.amount
| sort timestamp desc
| limit 50

Rank Snowflake accounts by total organization billing amount.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "org_costs"
| filter isNotNull(snowflake.account.name)
| summarize { total_billed = sum(toDouble(snowflake.org.billing.amount)) }, by: { snowflake.account.name }
| sort total_billed desc
| limit 25

Dynatrace Snowflake Observability Agent resource fields

Fields present on all Dynatrace Snowflake Observability Agent telemetry records. Synced with config.py RESOURCE_ATTRIBUTES.

Attribute	Type	Description	Examples
`db.system`	string	experimental Display name: `Database system` An identifier for the database management system (DBMS) product being used. See below for a list of well-known identifiers. ¹	`mongodb`; `mysql`
`deployment.environment`	string	resource deprecatedUse deployment.environment.name instead. Deprecated alias for deployment.environment.name. The deployment environment, for example, production, staging, or development. Will be removed in release 1.3.0. ²	`PROD`
`deployment.environment.name`	string	resource stable The deployment environment name (OTel semconv canonical field), for example, production, staging, or development. Emitted alongside deployment.environment during the deprecation window. ³	`PROD`
`deployment.environment.tag`	string	resource stable Optional tag for the deployment environment in multitenancy mode ⁴	`SA080`
`dsoa.run.context`	string	resource stable The name of the Dynatrace Snowflake Observability Agent context (part of plugin) used to produce the telemetry (logs, traces, metrics, or events). In case of multiple contexts within the same plugin, this helps differentiate between them. If plugin delivers only one context, this field will have the same value as the plugin name. ⁵	`users_all_roles`
`dsoa.run.id`	string	resource stable Unique ID of each execution of the Dynatrace Snowflake Observability Agent plugin. It can be used to differentiate between telemetry produced between two executions, for example, to calculate the change in the system. ⁶	`4aa7c76c-e98c-4b8b-a5b3-a8a721bbde2d`
`dsoa.run.plugin`	string	resource stable The name of the Dynatrace Snowflake Observability Agent plugin that produced this telemetry. Use to filter all telemetry from a specific plugin (for example, 'query_history', 'warehouse_usage'). Distinct from dsoa.run.context, which may represent a sub-context within a plugin. ⁷	`users`
`host.name`	string	resource experimental Display name: `Host name` The host name as determined on the data source (for instance, OneAgent, extensions or OpenTelemetry). Important: This is not the name of the host entity, which can be modified based on naming rules. ⁸ Tags: `permission`	`ip-10-178-54-32.ec2.internal`
`service.name`	string	resource stable Display name: `OTel service name` The logical name of the service. ⁹	`shoppingcart`
`telemetry.exporter.name`	string	resource experimental Display name: `Telemetry exporter name` The exporter name. ¹⁰	`odin`
`telemetry.exporter.version`	string	resource experimental Display name: `Telemetry exporter version` The full agent/exporter version. ¹¹	`1.285.1.20240101-256988`

Always 'snowflake' for all Dynatrace Snowflake Observability Agent telemetry.

User-configured deployment environment label, for example, 'PROD', 'STG', or 'DEV'. Set via 'core.snowflake.deployment_environment'.

⁴

Optional user-defined tag for grouping Snowflake accounts in multitenancy mode, set via 'core.tag'.

⁵

Identifies the specific sub-context within the plugin (for example, 'query_history', 'users_all_roles').

⁶

Unique identifier for a single Dynatrace Snowflake Observability Agent execution run. Changes on every invocation.

⁷

The Dynatrace Snowflake Observability Agent plugin that produced this telemetry (for example, 'query_history', 'warehouse_usage').

⁸

The Snowflake account hostname (for example, 'xy12345.snowflakecomputing.com'), from 'core.snowflake.host_name'.

⁹

Always the Snowflake account identifier without '.snowflakecomputing.com' suffix (for example, 'myorg-myaccount').

¹⁰

Always 'dynatrace.snowagent' — identifies Dynatrace Snowflake Observability Agent as the telemetry exporter.

¹¹

The installed Dynatrace Snowflake Observability Agent version in <major>.<minor>.<patch>.<build> format.

db.system has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`adabas`	Adabas (Adaptable Database System)	Adabas
`amazon-documentdb`	Amazon DocumentDB	DocumentDB
`aurora-mysql`	Amazon Aurora MySQL	Aurora MySQL
`aurora-postgresql`	Amazon Aurora PostgreSQL	Aurora PostgreSQL
`cache`	InterSystems Caché	InterSystems Caché
`cassandra`	Apache Cassandra	Cassandra
`clickhouse`	ClickHouse	ClickHouse
`cloudscape`	Cloudscape	Cloudscape
`cockroachdb`	CockroachDB	CockroachDB
`coldfusion`	ColdFusion IMQ	ColdFusion IMQ
`cosmosdb`	Microsoft Azure Cosmos DB	Cosmos DB
`couchbase`	Couchbase	Couchbase
`couchdb`	CouchDB	CouchDB
`databricks`	Databricks Data Platform	Databricks Data Platform
`db2`	IBM Db2	IBM Db2
`derby`	Apache Derby	Derby
`dl/i`	IBM DL/I	IBM DL/I
`dynamodb`	Amazon DynamoDB	DynamoDB
`edb`	EnterpriseDB	EnterpriseDB
`elasticsearch`	Elasticsearch	Elasticsearch
`filemaker`	FileMaker	FileMaker
`firebird`	Firebird	Firebird
`firstsql`	FirstSQL	FirstSQL
`geode`	Apache Geode	Geode
`h2`	H2	H2
`hanadb`	SAP HANA	SAP HANA
`hbase`	Apache HBase	HBase
`hive`	Apache Hive	Hive
`hsqldb`	HyperSQL DataBase	HSQLDB
`informix`	Informix	Informix
`ingres`	Ingres	Ingres
`instantdb`	InstantDB	InstantDB
`interbase`	InterBase	InterBase
`keyspaces-cassandra`	Amazon Keyspaces for Apache Cassandra	Keyspaces
`mariadb`	MariaDB	MariaDB
`maxdb`	SAP MaxDB	SAP MaxDB
`memcached`	Memcached	Memcached
`mongodb`	MongoDB	MongoDB
`mssql`	Microsoft SQL Server	SQL Server
`mssqlcompact`	Microsoft SQL Server Compact	SQL Server Compact
`mysql`	MySQL	MySQL
`neo4j`	Neo4j	Neo4j
`neptune`	Amazon Neptune	Neptune
`netezza`	Netezza	Netezza
`opensearch`	OpenSearch	OpenSearch
`oracle`	Oracle Database	Oracle
`other_sql`	Some other SQL database. Fallback only. See notes.	Other SQL
`pervasive`	Pervasive PSQL	Pervasive PSQL
`phoenix`	Apache Phoenix	Apache Phoenix
`pointbase`	PointBase	PointBase
`postgresql`	PostgreSQL	PostgreSQL
`progress`	Progress Database	Progress
`redis`	Redis	Redis
`redshift`	Amazon Redshift	Redshift
`snowflake`	Snowflake Data Platform	Snowflake Data Platform
`spanner`	Cloud Spanner	Cloud Spanner
`sqlite`	SQLite	SQLite
`sybase`	Sybase	Sybase
`teradata`	Teradata	Teradata
`valkey`	Valkey	Valkey
`vertica`	Vertica	Vertica

Organization costs log record fields

Attribute fields for organization costs log records.

Attribute	Type	Description	Examples
`snowflake.org.billing.contract_number`	string	experimental The contract number associated with the Snowflake billing balance.	`CONTRACT-001`

Snowflake query history log records

Log records emitted by the Dynatrace Snowflake Observability Agent query_history plugin.

Query

Fetch the 100 most recent Dynatrace Snowflake Observability Agent query_history plugin log entries from Grail.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "query_history"
| sort timestamp desc
| limit 100

Find Snowflake queries that ran longer than five minutes, with their user and warehouse.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "query_history"
| filter isNotNull(snowflake.query.id)
| fieldsAdd running_min = toLong(snowflake.time.total_elapsed) / 1000 / 60
| filter running_min > 5
| fields timestamp, snowflake.query.id, db.user, snowflake.warehouse.name, running_min
| sort running_min desc
| limit 50

Rank warehouses by the p90 execution time of their Snowflake queries.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "query_history"
| filter isNotNull(snowflake.warehouse.name)
| summarize {
    queries = count(),
    avg_exec_ms = avg(toLong(snowflake.time.execution)),
    p90_exec_ms = percentile(toLong(snowflake.time.execution), 90)
  }, by: { snowflake.warehouse.name }
| sort p90_exec_ms desc
| limit 25

Dynatrace Snowflake Observability Agent resource fields

Fields present on all Dynatrace Snowflake Observability Agent telemetry records. Synced with config.py RESOURCE_ATTRIBUTES.

Attribute	Type	Description	Examples
`db.system`	string	experimental Display name: `Database system` An identifier for the database management system (DBMS) product being used. See below for a list of well-known identifiers. ¹	`mongodb`; `mysql`
`deployment.environment`	string	resource deprecatedUse deployment.environment.name instead. Deprecated alias for deployment.environment.name. The deployment environment, for example, production, staging, or development. Will be removed in release 1.3.0. ²	`PROD`
`deployment.environment.name`	string	resource stable The deployment environment name (OTel semconv canonical field), for example, production, staging, or development. Emitted alongside deployment.environment during the deprecation window. ³	`PROD`
`deployment.environment.tag`	string	resource stable Optional tag for the deployment environment in multitenancy mode ⁴	`SA080`
`dsoa.run.context`	string	resource stable The name of the Dynatrace Snowflake Observability Agent context (part of plugin) used to produce the telemetry (logs, traces, metrics, or events). In case of multiple contexts within the same plugin, this helps differentiate between them. If plugin delivers only one context, this field will have the same value as the plugin name. ⁵	`users_all_roles`
`dsoa.run.id`	string	resource stable Unique ID of each execution of the Dynatrace Snowflake Observability Agent plugin. It can be used to differentiate between telemetry produced between two executions, for example, to calculate the change in the system. ⁶	`4aa7c76c-e98c-4b8b-a5b3-a8a721bbde2d`
`dsoa.run.plugin`	string	resource stable The name of the Dynatrace Snowflake Observability Agent plugin that produced this telemetry. Use to filter all telemetry from a specific plugin (for example, 'query_history', 'warehouse_usage'). Distinct from dsoa.run.context, which may represent a sub-context within a plugin. ⁷	`users`
`host.name`	string	resource experimental Display name: `Host name` The host name as determined on the data source (for instance, OneAgent, extensions or OpenTelemetry). Important: This is not the name of the host entity, which can be modified based on naming rules. ⁸ Tags: `permission`	`ip-10-178-54-32.ec2.internal`
`service.name`	string	resource stable Display name: `OTel service name` The logical name of the service. ⁹	`shoppingcart`
`telemetry.exporter.name`	string	resource experimental Display name: `Telemetry exporter name` The exporter name. ¹⁰	`odin`
`telemetry.exporter.version`	string	resource experimental Display name: `Telemetry exporter version` The full agent/exporter version. ¹¹	`1.285.1.20240101-256988`

Always 'snowflake' for all Dynatrace Snowflake Observability Agent telemetry.

User-configured deployment environment label, for example, 'PROD', 'STG', or 'DEV'. Set via 'core.snowflake.deployment_environment'.

⁴

Optional user-defined tag for grouping Snowflake accounts in multitenancy mode, set via 'core.tag'.

⁵

Identifies the specific sub-context within the plugin (for example, 'query_history', 'users_all_roles').

⁶

Unique identifier for a single Dynatrace Snowflake Observability Agent execution run. Changes on every invocation.

⁷

The Dynatrace Snowflake Observability Agent plugin that produced this telemetry (for example, 'query_history', 'warehouse_usage').

⁸

The Snowflake account hostname (for example, 'xy12345.snowflakecomputing.com'), from 'core.snowflake.host_name'.

⁹

Always the Snowflake account identifier without '.snowflakecomputing.com' suffix (for example, 'myorg-myaccount').

¹⁰

Always 'dynatrace.snowagent' — identifies Dynatrace Snowflake Observability Agent as the telemetry exporter.

¹¹

The installed Dynatrace Snowflake Observability Agent version in <major>.<minor>.<patch>.<build> format.

db.system has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`adabas`	Adabas (Adaptable Database System)	Adabas
`amazon-documentdb`	Amazon DocumentDB	DocumentDB
`aurora-mysql`	Amazon Aurora MySQL	Aurora MySQL
`aurora-postgresql`	Amazon Aurora PostgreSQL	Aurora PostgreSQL
`cache`	InterSystems Caché	InterSystems Caché
`cassandra`	Apache Cassandra	Cassandra
`clickhouse`	ClickHouse	ClickHouse
`cloudscape`	Cloudscape	Cloudscape
`cockroachdb`	CockroachDB	CockroachDB
`coldfusion`	ColdFusion IMQ	ColdFusion IMQ
`cosmosdb`	Microsoft Azure Cosmos DB	Cosmos DB
`couchbase`	Couchbase	Couchbase
`couchdb`	CouchDB	CouchDB
`databricks`	Databricks Data Platform	Databricks Data Platform
`db2`	IBM Db2	IBM Db2
`derby`	Apache Derby	Derby
`dl/i`	IBM DL/I	IBM DL/I
`dynamodb`	Amazon DynamoDB	DynamoDB
`edb`	EnterpriseDB	EnterpriseDB
`elasticsearch`	Elasticsearch	Elasticsearch
`filemaker`	FileMaker	FileMaker
`firebird`	Firebird	Firebird
`firstsql`	FirstSQL	FirstSQL
`geode`	Apache Geode	Geode
`h2`	H2	H2
`hanadb`	SAP HANA	SAP HANA
`hbase`	Apache HBase	HBase
`hive`	Apache Hive	Hive
`hsqldb`	HyperSQL DataBase	HSQLDB
`informix`	Informix	Informix
`ingres`	Ingres	Ingres
`instantdb`	InstantDB	InstantDB
`interbase`	InterBase	InterBase
`keyspaces-cassandra`	Amazon Keyspaces for Apache Cassandra	Keyspaces
`mariadb`	MariaDB	MariaDB
`maxdb`	SAP MaxDB	SAP MaxDB
`memcached`	Memcached	Memcached
`mongodb`	MongoDB	MongoDB
`mssql`	Microsoft SQL Server	SQL Server
`mssqlcompact`	Microsoft SQL Server Compact	SQL Server Compact
`mysql`	MySQL	MySQL
`neo4j`	Neo4j	Neo4j
`neptune`	Amazon Neptune	Neptune
`netezza`	Netezza	Netezza
`opensearch`	OpenSearch	OpenSearch
`oracle`	Oracle Database	Oracle
`other_sql`	Some other SQL database. Fallback only. See notes.	Other SQL
`pervasive`	Pervasive PSQL	Pervasive PSQL
`phoenix`	Apache Phoenix	Apache Phoenix
`pointbase`	PointBase	PointBase
`postgresql`	PostgreSQL	PostgreSQL
`progress`	Progress Database	Progress
`redis`	Redis	Redis
`redshift`	Amazon Redshift	Redshift
`snowflake`	Snowflake Data Platform	Snowflake Data Platform
`spanner`	Cloud Spanner	Cloud Spanner
`sqlite`	SQLite	SQLite
`sybase`	Sybase	Sybase
`teradata`	Teradata	Teradata
`valkey`	Valkey	Valkey
`vertica`	Vertica	Vertica

Query history log record fields

Attribute fields for query history log records.

Attribute	Type	Description	Examples
`db.snowflake.tables`	string[]	stable The tables involved in the query.	`['users', 'orders']`
`db.snowflake.views`	string[]	stable The views involved in the query. ¹	`['user_view']`
`dsoa.plugins.query_history.obfuscation_mode`	string	experimental Configuration key controlling query text obfuscation mode applied to `db.query.text` and `snowflake.error.message`. ²	`none`
`dsoa.plugins.query_history.track_ddl_changes`	boolean	experimental EXPERIMENTAL. When `true`, the plugin surfaces DDL change attribution attributes (`snowflake.object.type`, `.id`, `.name`, `snowflake.object.ddl.operation`, `snowflake.object.ddl.properties`) on `query_history` events whose `ACCESS_HISTORY` row carries an `OBJECT_MODIFIED_BY_DDL` payload. Covers database-object DDL only (tables, views, schemas, procedures). Warehouse and resource-monitor DDL does not populate `OBJECT_MODIFIED_BY_DDL` and is not affected by this setting — use `db.operation.name` for warehouse change detection. Default `false` preserves backward-compatible behavior. May be refactored into a dedicated plugin in a future release. ³	`false`
`snowflake.cluster_number`	long	experimental The warehouse cluster number associated with the query.	`1`
`snowflake.cost_attribution.period_end`	long	experimental End of the cost attribution summary window.	`1730844667000000000`
`snowflake.cost_attribution.period_start`	long	experimental Start of the cost attribution summary window.	`1730841067000000000`
`snowflake.database.id`	long	stable The unique identifier of the database involved in the query. ⁴	`123456`
`snowflake.object.ddl.operation`	string	stable The SQL keyword that specifies the operation on the table, view, or column.	`REPLACE`
`snowflake.object.type`	string	stable The domain of the object defined or modified by the DDL operation.	`Table`
`snowflake.query.accel_est.estimated_query_times`	string	stable Object that contains the estimated query execution time in seconds for different query acceleration scale factors. If the status for the query is not eligible for query acceleration, this object is empty. ⁵	`{ "scaleFactor1": 10, "scaleFactor2": 5 }`
`snowflake.query.accel_est.status`	string	stable Indicates whether the query is eligible to benefit from the query acceleration service.	`eligible`
`snowflake.query.accel_est.upper_limit_scale_factor`	long	stable Number of the highest query acceleration scale factor in the estimatedQueryTimes object. If the status for the query is not eligible for query acceleration, this field is set to 0.	`2`
`snowflake.query.data_transfer.inbound.cloud`	string	stable The cloud provider from which data was transferred inbound.	`AWS`
`snowflake.query.data_transfer.inbound.region`	string	stable The region from which data was transferred inbound.	`us-west-2`
`snowflake.query.data_transfer.outbound.cloud`	string	stable The cloud provider to which data was transferred outbound.	`AWS`
`snowflake.query.data_transfer.outbound.region`	string	stable The region to which data was transferred outbound.	`us-west-2`
`snowflake.query.is_client_generated`	boolean	stable Indicates if the statement was generated by the client.	`true`
`snowflake.query.retry_cause`	string	stable The cause for retrying the query, if applicable.	`Network issue`
`snowflake.query.transaction_id`	long	stable The transaction ID associated with the query.	`7890123456`
`snowflake.query.with_operator_stats`	boolean	experimental Indicates if the query was executed with operator-level statistics enabled.	`true`
`snowflake.release_version`	string	experimental The release version of Snowflake at the time of query execution.	`5.0`
`snowflake.role.type`	string	stable The type of role used to execute the query.	`PRIMARY`
`snowflake.schema.id`	long	experimental The unique identifier of the schema involved in the query.	`78901`
`snowflake.secondary_role_stats`	string	experimental Statistics related to secondary roles used during the query execution.	`role_stat1`
`snowflake.warehouse.cluster.number`	long	stable The cluster number of the warehouse used.	`1`
`snowflake.warehouse.id`	long	experimental The unique identifier of the warehouse used.	`12345`
`snowflake.warehouse.size`	string	stable The size of the warehouse used.	`X-SMALL`
`snowflake.warehouse.type`	string	stable The type of warehouse used.	`STANDARD`

Fully proprietary; no OTel analog.

Note: this is the SD-catalog attribute name; the actual config path read at runtime is plugins.query_history.obfuscation_mode (no dsoa. prefix) — see 050_f_get_query_history.sql.

Note: this is the SD-catalog attribute name; the actual config path is plugins.query_history.track_ddl_changes (no dsoa. prefix). Not currently wired up to any reader in code — setting this has no runtime effect yet.

⁴

ACCOUNT_USAGE.DATABASES supplies related fields (name, owner, owner_role_type, type, is_transient, lifecycle, retention_time, comment) but these should be populated by a future inventory plugin, not query_history (≈180-min latency + cost). In query_history, snowflake.database.id stays a foreign key only.

⁵

Serialized JSON object stored as string in Grail. Contains estimated query execution times per scale factor. Parse with parseJson() in DQL.

Snowflake shares log records

Log records emitted by the Dynatrace Snowflake Observability Agent shares plugin.

Query

Fetch the 100 most recent Dynatrace Snowflake Observability Agent shares plugin log entries (inbound and outbound shares) from Grail.

fetch logs
| filter db.system == "snowflake"
| filter in(dsoa.run.context, {"inbound_shares", "outbound_shares"})
| sort timestamp desc
| limit 100

Inspect outbound Snowflake shares and the objects they expose.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.context == "outbound_shares"
| filter isNotNull(snowflake.share.name)
| fields timestamp, snowflake.share.name, snowflake.table.full_name
| sort timestamp desc
| limit 50

Rank Snowflake shares by the number of shared objects they contain.

fetch logs
| filter db.system == "snowflake"
| filter in(dsoa.run.context, {"inbound_shares", "outbound_shares"})
| filter isNotNull(snowflake.share.name)
| summarize { objects = count() }, by: { snowflake.share.name }
| sort objects desc
| limit 25

Dynatrace Snowflake Observability Agent resource fields

Fields present on all Dynatrace Snowflake Observability Agent telemetry records. Synced with config.py RESOURCE_ATTRIBUTES.

Attribute	Type	Description	Examples
`db.system`	string	experimental Display name: `Database system` An identifier for the database management system (DBMS) product being used. See below for a list of well-known identifiers. ¹	`mongodb`; `mysql`
`deployment.environment`	string	resource deprecatedUse deployment.environment.name instead. Deprecated alias for deployment.environment.name. The deployment environment, for example, production, staging, or development. Will be removed in release 1.3.0. ²	`PROD`
`deployment.environment.name`	string	resource stable The deployment environment name (OTel semconv canonical field), for example, production, staging, or development. Emitted alongside deployment.environment during the deprecation window. ³	`PROD`
`deployment.environment.tag`	string	resource stable Optional tag for the deployment environment in multitenancy mode ⁴	`SA080`
`dsoa.run.context`	string	resource stable The name of the Dynatrace Snowflake Observability Agent context (part of plugin) used to produce the telemetry (logs, traces, metrics, or events). In case of multiple contexts within the same plugin, this helps differentiate between them. If plugin delivers only one context, this field will have the same value as the plugin name. ⁵	`users_all_roles`
`dsoa.run.id`	string	resource stable Unique ID of each execution of the Dynatrace Snowflake Observability Agent plugin. It can be used to differentiate between telemetry produced between two executions, for example, to calculate the change in the system. ⁶	`4aa7c76c-e98c-4b8b-a5b3-a8a721bbde2d`
`dsoa.run.plugin`	string	resource stable The name of the Dynatrace Snowflake Observability Agent plugin that produced this telemetry. Use to filter all telemetry from a specific plugin (for example, 'query_history', 'warehouse_usage'). Distinct from dsoa.run.context, which may represent a sub-context within a plugin. ⁷	`users`
`host.name`	string	resource experimental Display name: `Host name` The host name as determined on the data source (for instance, OneAgent, extensions or OpenTelemetry). Important: This is not the name of the host entity, which can be modified based on naming rules. ⁸ Tags: `permission`	`ip-10-178-54-32.ec2.internal`
`service.name`	string	resource stable Display name: `OTel service name` The logical name of the service. ⁹	`shoppingcart`
`telemetry.exporter.name`	string	resource experimental Display name: `Telemetry exporter name` The exporter name. ¹⁰	`odin`
`telemetry.exporter.version`	string	resource experimental Display name: `Telemetry exporter version` The full agent/exporter version. ¹¹	`1.285.1.20240101-256988`

Always 'snowflake' for all Dynatrace Snowflake Observability Agent telemetry.

User-configured deployment environment label, for example, 'PROD', 'STG', or 'DEV'. Set via 'core.snowflake.deployment_environment'.

⁴

Optional user-defined tag for grouping Snowflake accounts in multitenancy mode, set via 'core.tag'.

⁵

Identifies the specific sub-context within the plugin (for example, 'query_history', 'users_all_roles').

⁶

Unique identifier for a single Dynatrace Snowflake Observability Agent execution run. Changes on every invocation.

⁷

The Dynatrace Snowflake Observability Agent plugin that produced this telemetry (for example, 'query_history', 'warehouse_usage').

⁸

The Snowflake account hostname (for example, 'xy12345.snowflakecomputing.com'), from 'core.snowflake.host_name'.

⁹

Always the Snowflake account identifier without '.snowflakecomputing.com' suffix (for example, 'myorg-myaccount').

¹⁰

Always 'dynatrace.snowagent' — identifies Dynatrace Snowflake Observability Agent as the telemetry exporter.

¹¹

The installed Dynatrace Snowflake Observability Agent version in <major>.<minor>.<patch>.<build> format.

db.system has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`adabas`	Adabas (Adaptable Database System)	Adabas
`amazon-documentdb`	Amazon DocumentDB	DocumentDB
`aurora-mysql`	Amazon Aurora MySQL	Aurora MySQL
`aurora-postgresql`	Amazon Aurora PostgreSQL	Aurora PostgreSQL
`cache`	InterSystems Caché	InterSystems Caché
`cassandra`	Apache Cassandra	Cassandra
`clickhouse`	ClickHouse	ClickHouse
`cloudscape`	Cloudscape	Cloudscape
`cockroachdb`	CockroachDB	CockroachDB
`coldfusion`	ColdFusion IMQ	ColdFusion IMQ
`cosmosdb`	Microsoft Azure Cosmos DB	Cosmos DB
`couchbase`	Couchbase	Couchbase
`couchdb`	CouchDB	CouchDB
`databricks`	Databricks Data Platform	Databricks Data Platform
`db2`	IBM Db2	IBM Db2
`derby`	Apache Derby	Derby
`dl/i`	IBM DL/I	IBM DL/I
`dynamodb`	Amazon DynamoDB	DynamoDB
`edb`	EnterpriseDB	EnterpriseDB
`elasticsearch`	Elasticsearch	Elasticsearch
`filemaker`	FileMaker	FileMaker
`firebird`	Firebird	Firebird
`firstsql`	FirstSQL	FirstSQL
`geode`	Apache Geode	Geode
`h2`	H2	H2
`hanadb`	SAP HANA	SAP HANA
`hbase`	Apache HBase	HBase
`hive`	Apache Hive	Hive
`hsqldb`	HyperSQL DataBase	HSQLDB
`informix`	Informix	Informix
`ingres`	Ingres	Ingres
`instantdb`	InstantDB	InstantDB
`interbase`	InterBase	InterBase
`keyspaces-cassandra`	Amazon Keyspaces for Apache Cassandra	Keyspaces
`mariadb`	MariaDB	MariaDB
`maxdb`	SAP MaxDB	SAP MaxDB
`memcached`	Memcached	Memcached
`mongodb`	MongoDB	MongoDB
`mssql`	Microsoft SQL Server	SQL Server
`mssqlcompact`	Microsoft SQL Server Compact	SQL Server Compact
`mysql`	MySQL	MySQL
`neo4j`	Neo4j	Neo4j
`neptune`	Amazon Neptune	Neptune
`netezza`	Netezza	Netezza
`opensearch`	OpenSearch	OpenSearch
`oracle`	Oracle Database	Oracle
`other_sql`	Some other SQL database. Fallback only. See notes.	Other SQL
`pervasive`	Pervasive PSQL	Pervasive PSQL
`phoenix`	Apache Phoenix	Apache Phoenix
`pointbase`	PointBase	PointBase
`postgresql`	PostgreSQL	PostgreSQL
`progress`	Progress Database	Progress
`redis`	Redis	Redis
`redshift`	Amazon Redshift	Redshift
`snowflake`	Snowflake Data Platform	Snowflake Data Platform
`spanner`	Cloud Spanner	Cloud Spanner
`sqlite`	SQLite	SQLite
`sybase`	Sybase	Sybase
`teradata`	Teradata	Teradata
`valkey`	Valkey	Valkey
`vertica`	Vertica	Vertica

Shares log record fields

Attribute fields for shares log records.

Attribute	Type	Description	Examples
`snowflake.grant.by`	string	stable Shows the name of the account which made the grant.	`ACCOUNTADMIN`
`snowflake.grant.grantee`	string	stable Shows the grantee account name.	`PARTNER_ACCOUNT`
`snowflake.grant.on`	string	stable Shows on what type of object the grant was made.	`DATABASE`
`snowflake.grant.option`	boolean	experimental Indicates if grant option is available.	`false`
`snowflake.grant.privilege`	string	stable Shows the type of privilege granted.	`USAGE`
`snowflake.grant.to`	string	experimental Shows to what the grant was made.	`SHARE`
`snowflake.share.has_details_reported`	boolean	experimental Indicates whether or not details on this share should be reported.	`false`
`snowflake.share.is_secure_objects_only`	boolean	stable Indicates if the share is only for secure objects.	`true`
`snowflake.share.kind`	string	stable Indicates the type of share.	`OUTBOUND`
`snowflake.share.listing_global_name`	string	experimental Global name of the share listing.	`GLOBAL_SHARE_NAME`
`snowflake.share.owner`	string	stable Shows the account owning the share.	`ACCOUNTADMIN`
`snowflake.share.shared_from`	string	experimental Shows the owner account of the share.	`SNOWFLAKE`
`snowflake.share.shared_to`	string	experimental Shows the account the share was made to.	`PARTNER_ACCOUNT`
`snowflake.share.status`	string	stable Indicates the availability status of the share. Set to UNAVAILABLE when the shared database is no longer accessible.	`UNAVAILABLE`
`snowflake.table.clustering_key`	string	experimental Clustering key for the table.	`DATE`
`snowflake.table.comment`	string	experimental Comment for this table.	`The tables defined in this database that are accessible to the current user's role.`
`snowflake.table.is_auto_clustering_on`	boolean	experimental Indicates whether automatic clustering is enabled for the table.	`true`
`snowflake.table.is_dynamic`	boolean	experimental Indicates whether the table is a dynamic table.	`false`
`snowflake.table.is_hybrid`	boolean	experimental Indicates whether this is a hybrid table.	`false`
`snowflake.table.is_iceberg`	boolean	experimental Indicates whether the table is an Iceberg table.	`false`
`snowflake.table.is_temporary`	boolean	experimental Indicates whether this is a temporary table.	`false`
`snowflake.table.is_transient`	boolean	experimental Indicates whether this is a transient table.	`false`
`snowflake.table.last_ddl_by`	string	experimental The current username for the user who executed the last DDL operation.	`DBA_USER`
`snowflake.table.owner`	string	experimental Name of the role that owns the table.	`ACCOUNTADMIN`
`snowflake.table.retention_time`	long	experimental Number of days that historical data is retained for Time Travel.	`5`

Snowflake tasks log records

Log records emitted by the Dynatrace Snowflake Observability Agent tasks plugin.

Query

Fetch the 100 most recent Dynatrace Snowflake Observability Agent tasks plugin log entries from Grail.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "tasks"
| sort timestamp desc
| limit 100

Fetch log entries for failed Snowflake task runs.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "tasks"
| filter snowflake.task.run.state == "FAILED"
| fields timestamp, snowflake.task.name, snowflake.warehouse.name, snowflake.task.run.state
| sort timestamp desc
| limit 50

Rank Snowflake tasks by number of recorded runs.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "tasks"
| filter isNotNull(snowflake.task.name)
| summarize { runs = count() }, by: { snowflake.task.name }
| sort runs desc
| limit 25

Dynatrace Snowflake Observability Agent resource fields

Fields present on all Dynatrace Snowflake Observability Agent telemetry records. Synced with config.py RESOURCE_ATTRIBUTES.

Attribute	Type	Description	Examples
`db.system`	string	experimental Display name: `Database system` An identifier for the database management system (DBMS) product being used. See below for a list of well-known identifiers. ¹	`mongodb`; `mysql`
`deployment.environment`	string	resource deprecatedUse deployment.environment.name instead. Deprecated alias for deployment.environment.name. The deployment environment, for example, production, staging, or development. Will be removed in release 1.3.0. ²	`PROD`
`deployment.environment.name`	string	resource stable The deployment environment name (OTel semconv canonical field), for example, production, staging, or development. Emitted alongside deployment.environment during the deprecation window. ³	`PROD`
`deployment.environment.tag`	string	resource stable Optional tag for the deployment environment in multitenancy mode ⁴	`SA080`
`dsoa.run.context`	string	resource stable The name of the Dynatrace Snowflake Observability Agent context (part of plugin) used to produce the telemetry (logs, traces, metrics, or events). In case of multiple contexts within the same plugin, this helps differentiate between them. If plugin delivers only one context, this field will have the same value as the plugin name. ⁵	`users_all_roles`
`dsoa.run.id`	string	resource stable Unique ID of each execution of the Dynatrace Snowflake Observability Agent plugin. It can be used to differentiate between telemetry produced between two executions, for example, to calculate the change in the system. ⁶	`4aa7c76c-e98c-4b8b-a5b3-a8a721bbde2d`
`dsoa.run.plugin`	string	resource stable The name of the Dynatrace Snowflake Observability Agent plugin that produced this telemetry. Use to filter all telemetry from a specific plugin (for example, 'query_history', 'warehouse_usage'). Distinct from dsoa.run.context, which may represent a sub-context within a plugin. ⁷	`users`
`host.name`	string	resource experimental Display name: `Host name` The host name as determined on the data source (for instance, OneAgent, extensions or OpenTelemetry). Important: This is not the name of the host entity, which can be modified based on naming rules. ⁸ Tags: `permission`	`ip-10-178-54-32.ec2.internal`
`service.name`	string	resource stable Display name: `OTel service name` The logical name of the service. ⁹	`shoppingcart`
`telemetry.exporter.name`	string	resource experimental Display name: `Telemetry exporter name` The exporter name. ¹⁰	`odin`
`telemetry.exporter.version`	string	resource experimental Display name: `Telemetry exporter version` The full agent/exporter version. ¹¹	`1.285.1.20240101-256988`

Always 'snowflake' for all Dynatrace Snowflake Observability Agent telemetry.

User-configured deployment environment label, for example, 'PROD', 'STG', or 'DEV'. Set via 'core.snowflake.deployment_environment'.

⁴

Optional user-defined tag for grouping Snowflake accounts in multitenancy mode, set via 'core.tag'.

⁵

Identifies the specific sub-context within the plugin (for example, 'query_history', 'users_all_roles').

⁶

Unique identifier for a single Dynatrace Snowflake Observability Agent execution run. Changes on every invocation.

⁷

The Dynatrace Snowflake Observability Agent plugin that produced this telemetry (for example, 'query_history', 'warehouse_usage').

⁸

The Snowflake account hostname (for example, 'xy12345.snowflakecomputing.com'), from 'core.snowflake.host_name'.

⁹

Always the Snowflake account identifier without '.snowflakecomputing.com' suffix (for example, 'myorg-myaccount').

¹⁰

Always 'dynatrace.snowagent' — identifies Dynatrace Snowflake Observability Agent as the telemetry exporter.

¹¹

The installed Dynatrace Snowflake Observability Agent version in <major>.<minor>.<patch>.<build> format.

db.system has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`adabas`	Adabas (Adaptable Database System)	Adabas
`amazon-documentdb`	Amazon DocumentDB	DocumentDB
`aurora-mysql`	Amazon Aurora MySQL	Aurora MySQL
`aurora-postgresql`	Amazon Aurora PostgreSQL	Aurora PostgreSQL
`cache`	InterSystems Caché	InterSystems Caché
`cassandra`	Apache Cassandra	Cassandra
`clickhouse`	ClickHouse	ClickHouse
`cloudscape`	Cloudscape	Cloudscape
`cockroachdb`	CockroachDB	CockroachDB
`coldfusion`	ColdFusion IMQ	ColdFusion IMQ
`cosmosdb`	Microsoft Azure Cosmos DB	Cosmos DB
`couchbase`	Couchbase	Couchbase
`couchdb`	CouchDB	CouchDB
`databricks`	Databricks Data Platform	Databricks Data Platform
`db2`	IBM Db2	IBM Db2
`derby`	Apache Derby	Derby
`dl/i`	IBM DL/I	IBM DL/I
`dynamodb`	Amazon DynamoDB	DynamoDB
`edb`	EnterpriseDB	EnterpriseDB
`elasticsearch`	Elasticsearch	Elasticsearch
`filemaker`	FileMaker	FileMaker
`firebird`	Firebird	Firebird
`firstsql`	FirstSQL	FirstSQL
`geode`	Apache Geode	Geode
`h2`	H2	H2
`hanadb`	SAP HANA	SAP HANA
`hbase`	Apache HBase	HBase
`hive`	Apache Hive	Hive
`hsqldb`	HyperSQL DataBase	HSQLDB
`informix`	Informix	Informix
`ingres`	Ingres	Ingres
`instantdb`	InstantDB	InstantDB
`interbase`	InterBase	InterBase
`keyspaces-cassandra`	Amazon Keyspaces for Apache Cassandra	Keyspaces
`mariadb`	MariaDB	MariaDB
`maxdb`	SAP MaxDB	SAP MaxDB
`memcached`	Memcached	Memcached
`mongodb`	MongoDB	MongoDB
`mssql`	Microsoft SQL Server	SQL Server
`mssqlcompact`	Microsoft SQL Server Compact	SQL Server Compact
`mysql`	MySQL	MySQL
`neo4j`	Neo4j	Neo4j
`neptune`	Amazon Neptune	Neptune
`netezza`	Netezza	Netezza
`opensearch`	OpenSearch	OpenSearch
`oracle`	Oracle Database	Oracle
`other_sql`	Some other SQL database. Fallback only. See notes.	Other SQL
`pervasive`	Pervasive PSQL	Pervasive PSQL
`phoenix`	Apache Phoenix	Apache Phoenix
`pointbase`	PointBase	PointBase
`postgresql`	PostgreSQL	PostgreSQL
`progress`	Progress Database	Progress
`redis`	Redis	Redis
`redshift`	Amazon Redshift	Redshift
`snowflake`	Snowflake Data Platform	Snowflake Data Platform
`spanner`	Cloud Spanner	Cloud Spanner
`sqlite`	SQLite	SQLite
`sybase`	Sybase	Sybase
`teradata`	Teradata	Teradata
`valkey`	Valkey	Valkey
`vertica`	Vertica	Vertica

Tasks log record fields

Attribute fields for tasks log records.

Attribute	Type	Description	Examples
`snowflake.task.condition`	string	experimental The condition text of the task.	`status = 'SUCCESS'`
`snowflake.task.config.allow_overlap`	boolean	experimental Indicates if overlapping execution is allowed.	`true`
`snowflake.task.config.id`	string	experimental The configuration of the task.	`config123`
`snowflake.task.end_time`	long	experimental The end time of the task.	`1633046700000000000`
`snowflake.task.error_integration`	string	experimental Name of the notification integration used to access Amazon Simple Notification Service (SNS), Google Pub/Sub, or Microsoft Azure Event Grid to relay error notifications for the task.	`error_integration123`
`snowflake.task.graph.root_id`	string	experimental The root ID of the task graph.	`root123`
`snowflake.task.graph.version`	long	experimental The version of the task graph.	`1`
`snowflake.task.id`	long	experimental The unique identifier for the task.	`123456789`
`snowflake.task.instance_id`	long	stable Internal/system-generated identifier for the instance which the object belongs to.	`987654321`
`snowflake.task.last_committed_on`	long	experimental The last committed time of the task.	`1633046400000000000`
`snowflake.task.last_suspended_on`	long	experimental The last suspended time of the task.	`1633046700000000000`
`snowflake.task.owner`	string	experimental The owner of the task.	`admin`
`snowflake.task.predecessors`	string[]	experimental The predecessors of the task.	`['taskA', 'taskB']`
`snowflake.task.run.attempt`	long	stable The attempt number of the task run.	`1`
`snowflake.task.run.completed_time`	long	stable The completed time of the task run.	`1742824007586000000`
`snowflake.task.run.group_id`	string	experimental The group ID of the task run.	`group123`
`snowflake.task.run.id`	long	experimental The unique identifier for the task run.	`123456`
`snowflake.task.run.return_value`	string	experimental Value set for the predecessor task in a task graph. The return value is explicitly set by calling the SYSTEM$SET_RETURN_VALUE function by the predecessor task.	`0`
`snowflake.task.run.scheduled_from`	string	stable The source from which the task was scheduled.	`CRON`
`snowflake.task.run.scheduled_time`	long	stable The scheduled time of the task run.	`1742821828016000000`
`snowflake.task.run.state`	string	stable The state of the task run.	`RUNNING`
`snowflake.task.schedule`	string	experimental The schedule of the task.	`0 0 * * *`
`snowflake.task.start_time`	long	experimental The start time of the task.	`1633046400000000000`

Snowflake users log records

Log records emitted by the Dynatrace Snowflake Observability Agent users plugin.

Query

Fetch the 100 most recent Dynatrace Snowflake Observability Agent users plugin log entries from Grail.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "users"
| sort timestamp desc
| limit 100

Fetch log entries for disabled Snowflake users from the users plugin.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "users"
| filter snowflake.user.is_disabled == "true"
| sort timestamp desc
| limit 50

Fetch log entries for Snowflake users without MFA enabled.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "users"
| filter snowflake.user.has_mfa == "false"
| sort timestamp desc
| limit 50

Dynatrace Snowflake Observability Agent resource fields

Fields present on all Dynatrace Snowflake Observability Agent telemetry records. Synced with config.py RESOURCE_ATTRIBUTES.

Attribute	Type	Description	Examples
`db.system`	string	experimental Display name: `Database system` An identifier for the database management system (DBMS) product being used. See below for a list of well-known identifiers. ¹	`mongodb`; `mysql`
`deployment.environment`	string	resource deprecatedUse deployment.environment.name instead. Deprecated alias for deployment.environment.name. The deployment environment, for example, production, staging, or development. Will be removed in release 1.3.0. ²	`PROD`
`deployment.environment.name`	string	resource stable The deployment environment name (OTel semconv canonical field), for example, production, staging, or development. Emitted alongside deployment.environment during the deprecation window. ³	`PROD`
`deployment.environment.tag`	string	resource stable Optional tag for the deployment environment in multitenancy mode ⁴	`SA080`
`dsoa.run.context`	string	resource stable The name of the Dynatrace Snowflake Observability Agent context (part of plugin) used to produce the telemetry (logs, traces, metrics, or events). In case of multiple contexts within the same plugin, this helps differentiate between them. If plugin delivers only one context, this field will have the same value as the plugin name. ⁵	`users_all_roles`
`dsoa.run.id`	string	resource stable Unique ID of each execution of the Dynatrace Snowflake Observability Agent plugin. It can be used to differentiate between telemetry produced between two executions, for example, to calculate the change in the system. ⁶	`4aa7c76c-e98c-4b8b-a5b3-a8a721bbde2d`
`dsoa.run.plugin`	string	resource stable The name of the Dynatrace Snowflake Observability Agent plugin that produced this telemetry. Use to filter all telemetry from a specific plugin (for example, 'query_history', 'warehouse_usage'). Distinct from dsoa.run.context, which may represent a sub-context within a plugin. ⁷	`users`
`host.name`	string	resource experimental Display name: `Host name` The host name as determined on the data source (for instance, OneAgent, extensions or OpenTelemetry). Important: This is not the name of the host entity, which can be modified based on naming rules. ⁸ Tags: `permission`	`ip-10-178-54-32.ec2.internal`
`service.name`	string	resource stable Display name: `OTel service name` The logical name of the service. ⁹	`shoppingcart`
`telemetry.exporter.name`	string	resource experimental Display name: `Telemetry exporter name` The exporter name. ¹⁰	`odin`
`telemetry.exporter.version`	string	resource experimental Display name: `Telemetry exporter version` The full agent/exporter version. ¹¹	`1.285.1.20240101-256988`

Always 'snowflake' for all Dynatrace Snowflake Observability Agent telemetry.

User-configured deployment environment label, for example, 'PROD', 'STG', or 'DEV'. Set via 'core.snowflake.deployment_environment'.

⁴

Optional user-defined tag for grouping Snowflake accounts in multitenancy mode, set via 'core.tag'.

⁵

Identifies the specific sub-context within the plugin (for example, 'query_history', 'users_all_roles').

⁶

Unique identifier for a single Dynatrace Snowflake Observability Agent execution run. Changes on every invocation.

⁷

The Dynatrace Snowflake Observability Agent plugin that produced this telemetry (for example, 'query_history', 'warehouse_usage').

⁸

The Snowflake account hostname (for example, 'xy12345.snowflakecomputing.com'), from 'core.snowflake.host_name'.

⁹

Always the Snowflake account identifier without '.snowflakecomputing.com' suffix (for example, 'myorg-myaccount').

¹⁰

Always 'dynatrace.snowagent' — identifies Dynatrace Snowflake Observability Agent as the telemetry exporter.

¹¹

The installed Dynatrace Snowflake Observability Agent version in <major>.<minor>.<patch>.<build> format.

db.system has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`adabas`	Adabas (Adaptable Database System)	Adabas
`amazon-documentdb`	Amazon DocumentDB	DocumentDB
`aurora-mysql`	Amazon Aurora MySQL	Aurora MySQL
`aurora-postgresql`	Amazon Aurora PostgreSQL	Aurora PostgreSQL
`cache`	InterSystems Caché	InterSystems Caché
`cassandra`	Apache Cassandra	Cassandra
`clickhouse`	ClickHouse	ClickHouse
`cloudscape`	Cloudscape	Cloudscape
`cockroachdb`	CockroachDB	CockroachDB
`coldfusion`	ColdFusion IMQ	ColdFusion IMQ
`cosmosdb`	Microsoft Azure Cosmos DB	Cosmos DB
`couchbase`	Couchbase	Couchbase
`couchdb`	CouchDB	CouchDB
`databricks`	Databricks Data Platform	Databricks Data Platform
`db2`	IBM Db2	IBM Db2
`derby`	Apache Derby	Derby
`dl/i`	IBM DL/I	IBM DL/I
`dynamodb`	Amazon DynamoDB	DynamoDB
`edb`	EnterpriseDB	EnterpriseDB
`elasticsearch`	Elasticsearch	Elasticsearch
`filemaker`	FileMaker	FileMaker
`firebird`	Firebird	Firebird
`firstsql`	FirstSQL	FirstSQL
`geode`	Apache Geode	Geode
`h2`	H2	H2
`hanadb`	SAP HANA	SAP HANA
`hbase`	Apache HBase	HBase
`hive`	Apache Hive	Hive
`hsqldb`	HyperSQL DataBase	HSQLDB
`informix`	Informix	Informix
`ingres`	Ingres	Ingres
`instantdb`	InstantDB	InstantDB
`interbase`	InterBase	InterBase
`keyspaces-cassandra`	Amazon Keyspaces for Apache Cassandra	Keyspaces
`mariadb`	MariaDB	MariaDB
`maxdb`	SAP MaxDB	SAP MaxDB
`memcached`	Memcached	Memcached
`mongodb`	MongoDB	MongoDB
`mssql`	Microsoft SQL Server	SQL Server
`mssqlcompact`	Microsoft SQL Server Compact	SQL Server Compact
`mysql`	MySQL	MySQL
`neo4j`	Neo4j	Neo4j
`neptune`	Amazon Neptune	Neptune
`netezza`	Netezza	Netezza
`opensearch`	OpenSearch	OpenSearch
`oracle`	Oracle Database	Oracle
`other_sql`	Some other SQL database. Fallback only. See notes.	Other SQL
`pervasive`	Pervasive PSQL	Pervasive PSQL
`phoenix`	Apache Phoenix	Apache Phoenix
`pointbase`	PointBase	PointBase
`postgresql`	PostgreSQL	PostgreSQL
`progress`	Progress Database	Progress
`redis`	Redis	Redis
`redshift`	Amazon Redshift	Redshift
`snowflake`	Snowflake Data Platform	Snowflake Data Platform
`spanner`	Cloud Spanner	Cloud Spanner
`sqlite`	SQLite	SQLite
`sybase`	Sybase	Sybase
`teradata`	Teradata	Teradata
`valkey`	Valkey	Valkey
`vertica`	Vertica	Vertica

Users log record fields

Attribute fields for users log records.

Attribute	Type	Description	Examples
`snowflake.user.bypass_mfa_until`	long	experimental The time until which the user can bypass MFA. Epoch nanoseconds timestamp.	`1620213179885000000`
`snowflake.user.comment`	string	experimental Any comments associated with the user.	`New user account`
`snowflake.user.default.namespace`	string	stable The default namespace for the user.	`PUBLIC`
`snowflake.user.default.role`	string	stable The default role for the user.	`SYSADMIN`
`snowflake.user.default.secondary_role`	string	stable The default secondary role for the user.	`SECURITYADMIN`
`snowflake.user.default.warehouse`	string	stable The default warehouse for the user.	`COMPUTE_WH`
`snowflake.user.display_name`	string	experimental The display name of the user.	`John Doe`
`snowflake.user.email`	string	experimental The email address of the user.	`jdoe@example.com`
`snowflake.user.expires_at`	long	experimental The expiration date of the user account.	`1620213179885000000`
`snowflake.user.ext_authn.duo`	boolean	stable Indicates if Duo authentication is enabled for the user.	`true`
`snowflake.user.ext_authn.uid`	string	stable The external authentication UID for the user.	`ext123`
`snowflake.user.has_mfa`	boolean	stable Indicates if the user is enrolled for multi-factor authentication.	`true`
`snowflake.user.has_password`	boolean	stable Indicates if the user has a password set.	`true`
`snowflake.user.has_pat`	boolean	stable Indicates if a programmatic access token has been generated for the user.	`true`
`snowflake.user.has_rsa`	boolean	stable Indicates if RSA public key authentication is configured for the user.	`true`
`snowflake.user.has_workload_identity`	boolean	experimental Indicates if workload identity federation is configured for the user.	`true`
`snowflake.user.id`	long	experimental The unique identifier for the user.	`12345`
`snowflake.user.is_disabled`	boolean	stable Indicates if the user account is disabled.	`false`
`snowflake.user.is_from_organization`	boolean	experimental Indicates if the user was imported from a global organization.	`true`
`snowflake.user.is_locked`	boolean	stable Indicates if the user account is locked by Snowflake.	`false`
`snowflake.user.locked_until_time`	long	experimental The time until which the user account is locked.	`1615479617866000000`
`snowflake.user.must_change_password`	boolean	experimental Indicates if the user must change their password.	`true`
`snowflake.user.name.first`	string	stable The first name of the user.	`John`
`snowflake.user.name.last`	string	stable The last name of the user.	`Doe`
`snowflake.user.name.login`	string	experimental The login name of the user.	`jdoe`
`snowflake.user.owner`	string	stable The role that owns the user account.	`ACCOUNTADMIN`
`snowflake.user.privilege.granted_by`	string[]	experimental Array of all roles which granted grants to a user for a privilege. ¹	`['ACCOUNTADMIN']`
`snowflake.user.privilege.grants_on`	string[]	experimental List of all objects of given type on which given privilege was given; both object type and privilege are reported as `snowflake.user.privilege.name` ²	`['TRUST_CENTER_ADMIN', 'COMPUTE_WH']`
`snowflake.user.privilege.name`	string	stable Name of the privilege and type of object this privilege granted on to the user or role. Composed as `privilege:granted_on_object`.	`CREATE SERVICE:SCHEMA`
`snowflake.user.roles.all`	string	experimental Comma separated list of all roles granted to a user.	`SNOWFLAKE_FINANCE,MONITORING`
`snowflake.user.roles.direct.list`	string[]	stable List of all direct roles granted to user. ³	`['DEVOPS_ROLE', 'SYSADMIN', 'ACCOUNTADMIN']`
`snowflake.user.roles.direct.removed`	string	stable Name of the role that was revoked from user.	`ACCOUNTADMIN`
`snowflake.user.roles.granted_by`	string[]	experimental Array of admin roles that were used to grant current list of user roles. ⁴	`['DEMIGOD', 'SECURITYADMIN', 'ACCOUNTADMIN']`

Array of grantor role names stored as string[] in Grail.

Array of privilege grant target names stored as string[] in Grail.

Array of directly assigned role names stored as string[] in Grail.

⁴

Array of grantor names for role assignments stored as string[] in Grail.

Snowflake warehouse usage log records

Log records emitted by the Dynatrace Snowflake Observability Agent warehouse_usage plugin.

Query

Fetch the 100 most recent Dynatrace Snowflake Observability Agent warehouse_usage plugin log entries from Grail.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "warehouse_usage"
| sort timestamp desc
| limit 100

Inspect Snowflake warehouse state-change events (start, resume, suspend) from the warehouse_usage plugin.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "warehouse_usage"
| filter isNotNull(snowflake.warehouse.name)
| fields timestamp, snowflake.warehouse.name, snowflake.warehouse.event.name, snowflake.warehouse.event.state
| sort timestamp desc
| limit 50

Count Snowflake warehouse state-change events grouped by warehouse and event type.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "warehouse_usage"
| filter isNotNull(snowflake.warehouse.name)
| summarize { events = count() }, by: { snowflake.warehouse.name, snowflake.warehouse.event.name }
| sort events desc
| limit 25

Dynatrace Snowflake Observability Agent resource fields

Fields present on all Dynatrace Snowflake Observability Agent telemetry records. Synced with config.py RESOURCE_ATTRIBUTES.

Attribute	Type	Description	Examples
`db.system`	string	experimental Display name: `Database system` An identifier for the database management system (DBMS) product being used. See below for a list of well-known identifiers. ¹	`mongodb`; `mysql`
`deployment.environment`	string	resource deprecatedUse deployment.environment.name instead. Deprecated alias for deployment.environment.name. The deployment environment, for example, production, staging, or development. Will be removed in release 1.3.0. ²	`PROD`
`deployment.environment.name`	string	resource stable The deployment environment name (OTel semconv canonical field), for example, production, staging, or development. Emitted alongside deployment.environment during the deprecation window. ³	`PROD`
`deployment.environment.tag`	string	resource stable Optional tag for the deployment environment in multitenancy mode ⁴	`SA080`
`dsoa.run.context`	string	resource stable The name of the Dynatrace Snowflake Observability Agent context (part of plugin) used to produce the telemetry (logs, traces, metrics, or events). In case of multiple contexts within the same plugin, this helps differentiate between them. If plugin delivers only one context, this field will have the same value as the plugin name. ⁵	`users_all_roles`
`dsoa.run.id`	string	resource stable Unique ID of each execution of the Dynatrace Snowflake Observability Agent plugin. It can be used to differentiate between telemetry produced between two executions, for example, to calculate the change in the system. ⁶	`4aa7c76c-e98c-4b8b-a5b3-a8a721bbde2d`
`dsoa.run.plugin`	string	resource stable The name of the Dynatrace Snowflake Observability Agent plugin that produced this telemetry. Use to filter all telemetry from a specific plugin (for example, 'query_history', 'warehouse_usage'). Distinct from dsoa.run.context, which may represent a sub-context within a plugin. ⁷	`users`
`host.name`	string	resource experimental Display name: `Host name` The host name as determined on the data source (for instance, OneAgent, extensions or OpenTelemetry). Important: This is not the name of the host entity, which can be modified based on naming rules. ⁸ Tags: `permission`	`ip-10-178-54-32.ec2.internal`
`service.name`	string	resource stable Display name: `OTel service name` The logical name of the service. ⁹	`shoppingcart`
`telemetry.exporter.name`	string	resource experimental Display name: `Telemetry exporter name` The exporter name. ¹⁰	`odin`
`telemetry.exporter.version`	string	resource experimental Display name: `Telemetry exporter version` The full agent/exporter version. ¹¹	`1.285.1.20240101-256988`

Always 'snowflake' for all Dynatrace Snowflake Observability Agent telemetry.

User-configured deployment environment label, for example, 'PROD', 'STG', or 'DEV'. Set via 'core.snowflake.deployment_environment'.

⁴

Optional user-defined tag for grouping Snowflake accounts in multitenancy mode, set via 'core.tag'.

⁵

Identifies the specific sub-context within the plugin (for example, 'query_history', 'users_all_roles').

⁶

Unique identifier for a single Dynatrace Snowflake Observability Agent execution run. Changes on every invocation.

⁷

The Dynatrace Snowflake Observability Agent plugin that produced this telemetry (for example, 'query_history', 'warehouse_usage').

⁸

The Snowflake account hostname (for example, 'xy12345.snowflakecomputing.com'), from 'core.snowflake.host_name'.

⁹

Always the Snowflake account identifier without '.snowflakecomputing.com' suffix (for example, 'myorg-myaccount').

¹⁰

Always 'dynatrace.snowagent' — identifies Dynatrace Snowflake Observability Agent as the telemetry exporter.

¹¹

The installed Dynatrace Snowflake Observability Agent version in <major>.<minor>.<patch>.<build> format.

db.system has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`adabas`	Adabas (Adaptable Database System)	Adabas
`amazon-documentdb`	Amazon DocumentDB	DocumentDB
`aurora-mysql`	Amazon Aurora MySQL	Aurora MySQL
`aurora-postgresql`	Amazon Aurora PostgreSQL	Aurora PostgreSQL
`cache`	InterSystems Caché	InterSystems Caché
`cassandra`	Apache Cassandra	Cassandra
`clickhouse`	ClickHouse	ClickHouse
`cloudscape`	Cloudscape	Cloudscape
`cockroachdb`	CockroachDB	CockroachDB
`coldfusion`	ColdFusion IMQ	ColdFusion IMQ
`cosmosdb`	Microsoft Azure Cosmos DB	Cosmos DB
`couchbase`	Couchbase	Couchbase
`couchdb`	CouchDB	CouchDB
`databricks`	Databricks Data Platform	Databricks Data Platform
`db2`	IBM Db2	IBM Db2
`derby`	Apache Derby	Derby
`dl/i`	IBM DL/I	IBM DL/I
`dynamodb`	Amazon DynamoDB	DynamoDB
`edb`	EnterpriseDB	EnterpriseDB
`elasticsearch`	Elasticsearch	Elasticsearch
`filemaker`	FileMaker	FileMaker
`firebird`	Firebird	Firebird
`firstsql`	FirstSQL	FirstSQL
`geode`	Apache Geode	Geode
`h2`	H2	H2
`hanadb`	SAP HANA	SAP HANA
`hbase`	Apache HBase	HBase
`hive`	Apache Hive	Hive
`hsqldb`	HyperSQL DataBase	HSQLDB
`informix`	Informix	Informix
`ingres`	Ingres	Ingres
`instantdb`	InstantDB	InstantDB
`interbase`	InterBase	InterBase
`keyspaces-cassandra`	Amazon Keyspaces for Apache Cassandra	Keyspaces
`mariadb`	MariaDB	MariaDB
`maxdb`	SAP MaxDB	SAP MaxDB
`memcached`	Memcached	Memcached
`mongodb`	MongoDB	MongoDB
`mssql`	Microsoft SQL Server	SQL Server
`mssqlcompact`	Microsoft SQL Server Compact	SQL Server Compact
`mysql`	MySQL	MySQL
`neo4j`	Neo4j	Neo4j
`neptune`	Amazon Neptune	Neptune
`netezza`	Netezza	Netezza
`opensearch`	OpenSearch	OpenSearch
`oracle`	Oracle Database	Oracle
`other_sql`	Some other SQL database. Fallback only. See notes.	Other SQL
`pervasive`	Pervasive PSQL	Pervasive PSQL
`phoenix`	Apache Phoenix	Apache Phoenix
`pointbase`	PointBase	PointBase
`postgresql`	PostgreSQL	PostgreSQL
`progress`	Progress Database	Progress
`redis`	Redis	Redis
`redshift`	Amazon Redshift	Redshift
`snowflake`	Snowflake Data Platform	Snowflake Data Platform
`spanner`	Cloud Spanner	Cloud Spanner
`sqlite`	SQLite	SQLite
`sybase`	Sybase	Sybase
`teradata`	Teradata	Teradata
`valkey`	Valkey	Valkey
`vertica`	Vertica	Vertica

Warehouse usage log record fields

Attribute fields for warehouse usage log records.

Attribute	Type	Description	Examples
`snowflake.warehouse.clusters.count`	long	resource stable The number of clusters in the warehouse. ¹	`2`
`snowflake.warehouse.event.reason`	string	experimental The reason for the event.	`USER_REQUEST`

The .count suffix is deliberately preserved. Sibling metrics snowflake.warehouse.clusters.min, .max, and .started exist in the same namespace; using the bare plural snowflake.warehouse.clusters as a scalar would be ambiguous alongside them.

Snowflake log records

Query

Snowflake Resource Monitors log records

Query

Dynatrace Snowflake Observability Agent resource fields

Resource Monitors log record fields

Snowflake Snowpipes log records

Query

Dynatrace Snowflake Observability Agent resource fields

Snowpipes log record fields

Snowflake Trust Center log records

Query

Dynatrace Snowflake Observability Agent resource fields

Trust Center log record fields

Snowflake active queries log records

Query

Dynatrace Snowflake Observability Agent resource fields

Active queries log record fields

Snowflake budgets log records

Query

Dynatrace Snowflake Observability Agent resource fields

Budgets log record fields

Snowflake cold tables log records

Query

Dynatrace Snowflake Observability Agent resource fields

Cold tables log record fields

Snowflake data schemas log records

Query

Dynatrace Snowflake Observability Agent resource fields

Data schemas log record fields

Snowflake dynamic tables log records

Query

Dynatrace Snowflake Observability Agent resource fields

Dynamic tables log record fields

Snowflake login history log records

Query

Dynatrace Snowflake Observability Agent resource fields

Login history log record fields

Snowflake metering log records

Query

Dynatrace Snowflake Observability Agent resource fields

Metering log record fields

Snowflake organization costs log records

Query

Dynatrace Snowflake Observability Agent resource fields

Organization costs log record fields

Snowflake query history log records

Query

Dynatrace Snowflake Observability Agent resource fields

Query history log record fields

Snowflake shares log records

Query

Dynatrace Snowflake Observability Agent resource fields

Shares log record fields

Snowflake tasks log records

Query

Dynatrace Snowflake Observability Agent resource fields

Tasks log record fields

Snowflake users log records

Query

Dynatrace Snowflake Observability Agent resource fields

Users log record fields

Snowflake warehouse usage log records

Query

Dynatrace Snowflake Observability Agent resource fields

Warehouse usage log record fields