Snowflake log records

Latest Dynatrace
Reference

Log records emitted by Dynatrace Snowflake Observability Agent plugins from Snowflake ACCOUNT_USAGE and system views.

Query

Fetch the 100 most recent Dynatrace Snowflake Observability Agent metering plugin log entries from Grail.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "metering"
| sort timestamp desc
| limit 100

Inspect per-service credit consumption readings from the metering plugin.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "metering"
| filter isNotNull(snowflake.service.name)
| fields timestamp, snowflake.service.name, snowflake.service.type, snowflake.credits.used
| sort timestamp desc
| limit 50

Rank Snowflake services by total metered credit consumption.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "metering"
| filter isNotNull(snowflake.service.name)
| summarize { total_credits = sum(toDouble(snowflake.credits.used)) }, by: { snowflake.service.name }
| sort total_credits desc
| limit 25

Snowflake Resource Monitors log records

Log records emitted by the Dynatrace Snowflake Observability Agent resource_monitors plugin.

Query

Fetch the 100 most recent Dynatrace Snowflake Observability Agent resource_monitors plugin log entries from Grail.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "resource_monitors"
| sort timestamp desc
| limit 100

Inspect per-monitor credit quota consumption readings from the resource_monitors plugin.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "resource_monitors"
| filter isNotNull(snowflake.resource_monitor.name)
| fields timestamp, snowflake.resource_monitor.name, snowflake.credits.quota.used, snowflake.credits.quota.used_pct
| sort timestamp desc
| limit 50

Fetch resource monitors that have consumed more than 90% of their credit quota.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "resource_monitors"
| filter toDouble(snowflake.credits.quota.used_pct) > 90
| sort timestamp desc
| limit 50

Dynatrace Snowflake Observability Agent resource fields

Fields present on all Dynatrace Snowflake Observability Agent telemetry records. Synced with config.py RESOURCE_ATTRIBUTES.

Attribute	Type	Description	Examples
`db.system`	string	experimental Display name: `Database system` An identifier for the database management system (DBMS) product being used. See below for a list of well-known identifiers. ¹	`mongodb`; `mysql`
`deployment.environment`	string	resource deprecated Use deployment.environment.name instead. Display name: `Snowflake deployment environment` Deprecated alias for deployment.environment.name. The deployment environment, for example, production, staging, or development. Will be removed in release 1.3.0. ²	`PROD`
`deployment.environment.name`	string	resource stable Display name: `Snowflake deployment environment name` The deployment environment name (OTel semconv canonical field), for example, production, staging, or development. Emitted alongside deployment.environment during the deprecation window. ³	`PROD`
`deployment.environment.tag`	string	resource stable Display name: `Deployment environment tag` Optional tag for the deployment environment in multitenancy mode ⁴	`SA080`
`dsoa.run.context`	string	resource stable Display name: `Dynatrace Snowflake Observability Agent execution context` The name of the Dynatrace Snowflake Observability Agent context (part of plugin) used to produce the telemetry (logs, traces, metrics, or events). In case of multiple contexts within the same plugin, this helps differentiate between them. If plugin delivers only one context, this field will have the same value as the plugin name. ⁵	`users_all_roles`
`dsoa.run.id`	string	resource stable Display name: `Dynatrace Snowflake Observability Agent execution unique identifier` Unique ID of each execution of the Dynatrace Snowflake Observability Agent plugin. It can be used to differentiate between telemetry produced between two executions, for example, to calculate the change in the system. ⁶	`4aa7c76c-e98c-4b8b-a5b3-a8a721bbde2d`
`dsoa.run.plugin`	string	resource stable Display name: `Dynatrace Snowflake Observability Agent execution plugin name` The name of the Dynatrace Snowflake Observability Agent plugin that produced this telemetry. Use to filter all telemetry from a specific plugin (for example, 'query_history', 'warehouse_usage'). Distinct from dsoa.run.context, which may represent a sub-context within a plugin. ⁷	`users`
`host.name`	string	resource experimental Display name: `Host name` The host name as determined on the data source (for instance, OneAgent, extensions or OpenTelemetry). Important: This is not the name of the host entity, which can be modified based on naming rules. ⁸ Tags: `permission`	`ip-10-178-54-32.ec2.internal`
`service.name`	string	resource stable Display name: `OTel service name` The logical name of the service. ⁹	`shoppingcart`
`telemetry.exporter.name`	string	resource experimental Display name: `Telemetry exporter name` The exporter name. ¹⁰	`odin`
`telemetry.exporter.version`	string	resource experimental Display name: `Telemetry exporter version` The full agent/exporter version. ¹¹	`1.285.1.20240101-256988`

Always 'snowflake' for all Dynatrace Snowflake Observability Agent telemetry.

User-configured deployment environment label, for example, 'PROD', 'STG', or 'DEV'. Set via 'core.snowflake.deployment_environment'.

User-configured deployment environment label (OTel-stable canonical key), for example, 'PROD', 'STG', or 'DEV'. Set via 'core.snowflake.deployment_environment'. Prefer this key over the deprecated deployment.environment alias.

⁴

Optional user-defined tag for grouping Snowflake accounts in multitenancy mode, set via 'core.tag'.

⁵

Identifies the specific sub-context within the plugin (for example, 'query_history', 'users_all_roles').

⁶

Unique identifier for a single Dynatrace Snowflake Observability Agent execution run. Changes on every invocation.

⁷

The Dynatrace Snowflake Observability Agent plugin that produced this telemetry (for example, 'query_history', 'warehouse_usage').

⁸

The Snowflake account hostname (for example, 'xy12345.snowflakecomputing.com'), from 'core.snowflake.host_name'.

⁹

Always the Snowflake account identifier without '.snowflakecomputing.com' suffix (for example, 'myorg-myaccount').

¹⁰

Always 'dynatrace.snowagent' — identifies Dynatrace Snowflake Observability Agent as the telemetry exporter.

¹¹

The installed Dynatrace Snowflake Observability Agent version in <major>.<minor>.<patch>.<build> format.

db.system has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`adabas`	Adabas (Adaptable Database System)	Adabas
`amazon-documentdb`	Amazon DocumentDB	DocumentDB
`aurora-mysql`	Amazon Aurora MySQL	Aurora MySQL
`aurora-postgresql`	Amazon Aurora PostgreSQL	Aurora PostgreSQL
`cache`	InterSystems Caché	InterSystems Caché
`cassandra`	Apache Cassandra	Cassandra
`clickhouse`	ClickHouse	ClickHouse
`cloudscape`	Cloudscape	Cloudscape
`cockroachdb`	CockroachDB	CockroachDB
`coldfusion`	ColdFusion IMQ	ColdFusion IMQ
`cosmosdb`	Microsoft Azure Cosmos DB	Cosmos DB
`couchbase`	Couchbase	Couchbase
`couchdb`	CouchDB	CouchDB
`databricks`	Databricks Data Platform	Databricks Data Platform
`db2`	IBM Db2	IBM Db2
`derby`	Apache Derby	Derby
`dl/i`	IBM DL/I	IBM DL/I
`dynamodb`	Amazon DynamoDB	DynamoDB
`edb`	EnterpriseDB	EnterpriseDB
`elasticsearch`	Elasticsearch	Elasticsearch
`filemaker`	FileMaker	FileMaker
`firebird`	Firebird	Firebird
`firstsql`	FirstSQL	FirstSQL
`geode`	Apache Geode	Geode
`h2`	H2	H2
`hanadb`	SAP HANA	SAP HANA
`hbase`	Apache HBase	HBase
`hive`	Apache Hive	Hive
`hsqldb`	HyperSQL DataBase	HSQLDB
`informix`	Informix	Informix
`ingres`	Ingres	Ingres
`instantdb`	InstantDB	InstantDB
`interbase`	InterBase	InterBase
`keyspaces-cassandra`	Amazon Keyspaces for Apache Cassandra	Keyspaces
`mariadb`	MariaDB	MariaDB
`maxdb`	SAP MaxDB	SAP MaxDB
`memcached`	Memcached	Memcached
`mongodb`	MongoDB	MongoDB
`mssql`	Microsoft SQL Server	SQL Server
`mssqlcompact`	Microsoft SQL Server Compact	SQL Server Compact
`mysql`	MySQL	MySQL
`neo4j`	Neo4j	Neo4j
`neptune`	Amazon Neptune	Neptune
`netezza`	Netezza	Netezza
`opensearch`	OpenSearch	OpenSearch
`oracle`	Oracle Database	Oracle
`other_sql`	Some other SQL database. Fallback only. See notes.	Other SQL
`pervasive`	Pervasive PSQL	Pervasive PSQL
`phoenix`	Apache Phoenix	Apache Phoenix
`pointbase`	PointBase	PointBase
`postgresql`	PostgreSQL	PostgreSQL
`progress`	Progress Database	Progress
`redis`	Redis	Redis
`redshift`	Amazon Redshift	Redshift
`snowflake`	Snowflake Data Platform	Snowflake Data Platform
`spanner`	Cloud Spanner	Cloud Spanner
`sqlite`	SQLite	SQLite
`sybase`	Sybase	Sybase
`teradata`	Teradata	Teradata
`valkey`	Valkey	Valkey
`vertica`	Vertica	Vertica

Resource Monitors log record fields

Attribute fields for Resource Monitors log records.

Attribute	Type	Description	Examples
`snowflake.resource_monitor.frequency`	string	resource stable Display name: `Snowflake resource monitor frequency` The frequency of the resource monitor.	`DAILY`
`snowflake.resource_monitor.is_active`	boolean	stable Display name: `Snowflake resource monitor active indicator` Indicates if the resource monitor is active.	`true`
`snowflake.resource_monitor.level`	string	resource experimental Display name: `Snowflake resource monitor level` The level of the resource monitor.	`ACCOUNT`
`snowflake.resource_monitor.threshold.direction`	string	experimental Display name: `Snowflake resource monitor threshold crossing direction` Direction of the threshold crossing: `up` when quota is increasing into or remaining within a band; `down` when the consumption drops back below a previously active band.	`up`
`snowflake.resource_monitor.threshold.level`	string	experimental Display name: `Snowflake resource monitor threshold alert band` Alert band for the threshold event.	`warn`
`snowflake.resource_monitor.threshold.value`	double	experimental Display name: `Snowflake resource monitor threshold value` Alert band the resource monitor's credit usage fell into when the event was emitted: one of `info`, `warn`, `critical`, or `exhausted` (increasing severity). The percentage boundaries for each band are configurable via `plugins.resource\_monitors.credits\_quota\_thresholds` (default `[50, 80, 90, 100]`); the specific crossed percentage is reported in `snowflake.resource\_monitor.threshold.value`. The configured threshold percentage at which this crossing event was triggered (for example, 80 means the 80% threshold was crossed). Distinct from snowflake.credits.quota.used_pct, which captures live consumption at emit time.	`80.0`
`snowflake.resource_monitor.warehouses`	string[]	experimental Display name: `Snowflake resource monitor warehouses` The names of the warehouses monitored.	`['COMPUTE_WH']`
`snowflake.warehouse.event.trigger`	string	experimental Display name: `Snowflake warehouse event trigger` The event that triggered the "warehouse is not monitored" notification.	`snowflake.warehouse.created_on`
`snowflake.warehouse.execution_state`	string	resource stable Display name: `Snowflake warehouse execution state` The execution state of the warehouse.	`RUNNING`
`snowflake.warehouse.has_query_acceleration_enabled`	boolean	resource experimental Display name: `Snowflake warehouse query acceleration indicator` Indicates if query acceleration is enabled for the warehouse.	`true`
`snowflake.warehouse.is_auto_resume`	boolean	resource stable Display name: `Snowflake warehouse auto-resume indicator` Indicates if the warehouse is set to auto-resume.	`true`
`snowflake.warehouse.is_current`	boolean	experimental Display name: `Snowflake warehouse current indicator` Indicates if the warehouse is the current warehouse.	`true`
`snowflake.warehouse.is_default`	boolean	experimental Display name: `Snowflake warehouse default indicator` Indicates if the warehouse is the default warehouse.	`true`
`snowflake.warehouse.is_unmonitored`	boolean	stable Display name: `Snowflake warehouse unmonitored indicator` Indicates if the warehouse is NOT monitored by a resource monitor.	`true`
`snowflake.warehouse.owner.name`	string	resource experimental Display name: `Snowflake warehouse owner name` The owner of the warehouse.	`ADMIN`
`snowflake.warehouse.owner.role_type`	string	experimental Display name: `Snowflake warehouse owner role type` The principal type of the warehouse owner: ROLE or APPLICATION.	`ROLE`
`snowflake.warehouse.scaling_policy`	string	resource stable Display name: `Snowflake warehouse scaling policy` The scaling policy of the warehouse.	`STANDARD`

Snowflake Snowpipes log records

Log records emitted by the Dynatrace Snowflake Observability Agent snowpipes plugin.

Query

Fetch the 100 most recent Dynatrace Snowflake Observability Agent snowpipes plugin log entries from Grail.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "snowpipes"
| sort timestamp desc
| limit 100

Fetch Snowpipe readings that reported ingestion errors.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "snowpipes"
| filter toLong(snowflake.pipe.errors) > 0
| fields timestamp, snowflake.pipe.name, snowflake.pipe.errors, snowflake.pipe.files.pending
| sort timestamp desc
| limit 50

Rank Snowpipes by total rows loaded.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "snowpipes"
| filter isNotNull(snowflake.pipe.name)
| summarize { total_rows = sum(toLong(snowflake.pipe.rows.loaded)) }, by: { snowflake.pipe.name }
| sort total_rows desc
| limit 25

Dynatrace Snowflake Observability Agent resource fields

Fields present on all Dynatrace Snowflake Observability Agent telemetry records. Synced with config.py RESOURCE_ATTRIBUTES.

Attribute	Type	Description	Examples
`db.system`	string	experimental Display name: `Database system` An identifier for the database management system (DBMS) product being used. See below for a list of well-known identifiers. ¹	`mongodb`; `mysql`
`deployment.environment`	string	resource deprecated Use deployment.environment.name instead. Display name: `Snowflake deployment environment` Deprecated alias for deployment.environment.name. The deployment environment, for example, production, staging, or development. Will be removed in release 1.3.0. ²	`PROD`
`deployment.environment.name`	string	resource stable Display name: `Snowflake deployment environment name` The deployment environment name (OTel semconv canonical field), for example, production, staging, or development. Emitted alongside deployment.environment during the deprecation window. ³	`PROD`
`deployment.environment.tag`	string	resource stable Display name: `Deployment environment tag` Optional tag for the deployment environment in multitenancy mode ⁴	`SA080`
`dsoa.run.context`	string	resource stable Display name: `Dynatrace Snowflake Observability Agent execution context` The name of the Dynatrace Snowflake Observability Agent context (part of plugin) used to produce the telemetry (logs, traces, metrics, or events). In case of multiple contexts within the same plugin, this helps differentiate between them. If plugin delivers only one context, this field will have the same value as the plugin name. ⁵	`users_all_roles`
`dsoa.run.id`	string	resource stable Display name: `Dynatrace Snowflake Observability Agent execution unique identifier` Unique ID of each execution of the Dynatrace Snowflake Observability Agent plugin. It can be used to differentiate between telemetry produced between two executions, for example, to calculate the change in the system. ⁶	`4aa7c76c-e98c-4b8b-a5b3-a8a721bbde2d`
`dsoa.run.plugin`	string	resource stable Display name: `Dynatrace Snowflake Observability Agent execution plugin name` The name of the Dynatrace Snowflake Observability Agent plugin that produced this telemetry. Use to filter all telemetry from a specific plugin (for example, 'query_history', 'warehouse_usage'). Distinct from dsoa.run.context, which may represent a sub-context within a plugin. ⁷	`users`
`host.name`	string	resource experimental Display name: `Host name` The host name as determined on the data source (for instance, OneAgent, extensions or OpenTelemetry). Important: This is not the name of the host entity, which can be modified based on naming rules. ⁸ Tags: `permission`	`ip-10-178-54-32.ec2.internal`
`service.name`	string	resource stable Display name: `OTel service name` The logical name of the service. ⁹	`shoppingcart`
`telemetry.exporter.name`	string	resource experimental Display name: `Telemetry exporter name` The exporter name. ¹⁰	`odin`
`telemetry.exporter.version`	string	resource experimental Display name: `Telemetry exporter version` The full agent/exporter version. ¹¹	`1.285.1.20240101-256988`

Always 'snowflake' for all Dynatrace Snowflake Observability Agent telemetry.

User-configured deployment environment label, for example, 'PROD', 'STG', or 'DEV'. Set via 'core.snowflake.deployment_environment'.

⁴

Optional user-defined tag for grouping Snowflake accounts in multitenancy mode, set via 'core.tag'.

⁵

Identifies the specific sub-context within the plugin (for example, 'query_history', 'users_all_roles').

⁶

Unique identifier for a single Dynatrace Snowflake Observability Agent execution run. Changes on every invocation.

⁷

The Dynatrace Snowflake Observability Agent plugin that produced this telemetry (for example, 'query_history', 'warehouse_usage').

⁸

The Snowflake account hostname (for example, 'xy12345.snowflakecomputing.com'), from 'core.snowflake.host_name'.

⁹

Always the Snowflake account identifier without '.snowflakecomputing.com' suffix (for example, 'myorg-myaccount').

¹⁰

Always 'dynatrace.snowagent' — identifies Dynatrace Snowflake Observability Agent as the telemetry exporter.

¹¹

The installed Dynatrace Snowflake Observability Agent version in <major>.<minor>.<patch>.<build> format.

db.system has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`adabas`	Adabas (Adaptable Database System)	Adabas
`amazon-documentdb`	Amazon DocumentDB	DocumentDB
`aurora-mysql`	Amazon Aurora MySQL	Aurora MySQL
`aurora-postgresql`	Amazon Aurora PostgreSQL	Aurora PostgreSQL
`cache`	InterSystems Caché	InterSystems Caché
`cassandra`	Apache Cassandra	Cassandra
`clickhouse`	ClickHouse	ClickHouse
`cloudscape`	Cloudscape	Cloudscape
`cockroachdb`	CockroachDB	CockroachDB
`coldfusion`	ColdFusion IMQ	ColdFusion IMQ
`cosmosdb`	Microsoft Azure Cosmos DB	Cosmos DB
`couchbase`	Couchbase	Couchbase
`couchdb`	CouchDB	CouchDB
`databricks`	Databricks Data Platform	Databricks Data Platform
`db2`	IBM Db2	IBM Db2
`derby`	Apache Derby	Derby
`dl/i`	IBM DL/I	IBM DL/I
`dynamodb`	Amazon DynamoDB	DynamoDB
`edb`	EnterpriseDB	EnterpriseDB
`elasticsearch`	Elasticsearch	Elasticsearch
`filemaker`	FileMaker	FileMaker
`firebird`	Firebird	Firebird
`firstsql`	FirstSQL	FirstSQL
`geode`	Apache Geode	Geode
`h2`	H2	H2
`hanadb`	SAP HANA	SAP HANA
`hbase`	Apache HBase	HBase
`hive`	Apache Hive	Hive
`hsqldb`	HyperSQL DataBase	HSQLDB
`informix`	Informix	Informix
`ingres`	Ingres	Ingres
`instantdb`	InstantDB	InstantDB
`interbase`	InterBase	InterBase
`keyspaces-cassandra`	Amazon Keyspaces for Apache Cassandra	Keyspaces
`mariadb`	MariaDB	MariaDB
`maxdb`	SAP MaxDB	SAP MaxDB
`memcached`	Memcached	Memcached
`mongodb`	MongoDB	MongoDB
`mssql`	Microsoft SQL Server	SQL Server
`mssqlcompact`	Microsoft SQL Server Compact	SQL Server Compact
`mysql`	MySQL	MySQL
`neo4j`	Neo4j	Neo4j
`neptune`	Amazon Neptune	Neptune
`netezza`	Netezza	Netezza
`opensearch`	OpenSearch	OpenSearch
`oracle`	Oracle Database	Oracle
`other_sql`	Some other SQL database. Fallback only. See notes.	Other SQL
`pervasive`	Pervasive PSQL	Pervasive PSQL
`phoenix`	Apache Phoenix	Apache Phoenix
`pointbase`	PointBase	PointBase
`postgresql`	PostgreSQL	PostgreSQL
`progress`	Progress Database	Progress
`redis`	Redis	Redis
`redshift`	Amazon Redshift	Redshift
`snowflake`	Snowflake Data Platform	Snowflake Data Platform
`spanner`	Cloud Spanner	Cloud Spanner
`sqlite`	SQLite	SQLite
`sybase`	Sybase	Sybase
`teradata`	Teradata	Teradata
`valkey`	Valkey	Valkey
`vertica`	Vertica	Vertica

Snowpipes log record fields

Attribute fields for Snowpipes log records.

Attribute	Type	Description	Examples
`snowflake.copy.errors.limit`	long	experimental Display name: `Snowflake copy error limit` Error limit for the COPY.	`1`
`snowflake.copy.file_name`	string	experimental Display name: `Snowflake copy source file name` Source file name.	`data/file_20250312.csv.gz`
`snowflake.copy.first_commit_time`	long	experimental Display name: `Snowflake copy first commit time` When the first chunk of the file was committed.	`1741772160000000000`
`snowflake.copy.first_error.character_position`	long	experimental Display name: `Snowflake copy first error character position` Character position of first error.	`128`
`snowflake.copy.first_error.column_name`	string	experimental Display name: `Snowflake copy first error column name` Column name causing the first error.	`AMOUNT`
`snowflake.copy.first_error.line_number`	long	experimental Display name: `Snowflake copy first error line number` Line number of first error.	`42`
`snowflake.copy.first_error.message`	string	experimental Display name: `Snowflake copy first error message` First error message for failed loads.	`Number of columns in file (3) does not match that of the corresponding table (4)`
`snowflake.copy.pipe.received_time`	long	experimental Display name: `Snowflake pipe file received time` When file was received by Snowpipe (view-only).	`1741772100000000000`
`snowflake.copy.stage_location`	string	experimental Display name: `Snowflake copy stage location` Stage location (ACCOUNT_USAGE view-only).	`s3://my-bucket/data/`
`snowflake.copy.status`	string	experimental Display name: `Snowflake copy status` Load status of the COPY INTO operation.	`LOADED`
`snowflake.pipe.definition`	string	experimental Display name: `Snowflake pipe COPY statement` The pipe's COPY statement.	`COPY INTO MY_DB.MY_SCHEMA.TARGET_TABLE FROM @MY_DB.MY_SCHEMA.MY_STAGE`
`snowflake.pipe.execution_state`	string	stable Display name: `Snowflake pipe execution state` Raw execution state from `SYSTEM$PIPE\_STATUS`.	`RUNNING`
`snowflake.pipe.invalid_reason`	string	experimental Display name: `Snowflake pipe invalid state reason` Reason the pipe is in an invalid state.	`Pipe paused by user`
`snowflake.pipe.last_ingested_timestamp`	string	experimental Display name: `Snowflake pipe last ingested file timestamp` Most recent file ingestion timestamp.	`2025-03-12 08:58:41.695 Z`
`snowflake.pipe.last_received_message_timestamp`	string	experimental Display name: `Snowflake pipe last received notification timestamp` Most recent event notification timestamp.	`2025-03-12 08:57:30.000 Z`
`snowflake.pipe.notification_channel`	string	experimental Display name: `Snowflake pipe notification channel URL` Cloud notification channel URL.	`arn:aws:sqs:us-east-1:123456789012:sf-snowpipe-AIDAEXAMPLE-pipeId`
`snowflake.pipe.oldest_file_timestamp`	string	experimental Display name: `Snowflake pipe oldest pending file timestamp` Timestamp of oldest pending file.	`2025-03-12 08:50:00.000 Z`
`snowflake.pipe.usage.start_time`	string	experimental Display name: `Snowflake pipe usage window start time` Start of the usage aggregation window.	`2025-03-12 08:00:00.000 Z`

Snowflake Trust Center log records

Log records emitted by the Dynatrace Snowflake Observability Agent trust_center plugin.

Query

Fetch the 100 most recent Dynatrace Snowflake Observability Agent trust_center plugin log entries from Grail.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "trust_center"
| sort timestamp desc
| limit 100

Fetch critical-severity Trust Center findings reported by the trust_center plugin.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "trust_center"
| filter vulnerability.risk.level == "CRITICAL"
| sort timestamp desc
| limit 50

Break down Trust Center findings by scanner type and risk level.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "trust_center"
| summarize { findings = count() }, by: { snowflake.trust_center.scanner.type, vulnerability.risk.level }
| sort findings desc
| limit 25

Dynatrace Snowflake Observability Agent resource fields

Fields present on all Dynatrace Snowflake Observability Agent telemetry records. Synced with config.py RESOURCE_ATTRIBUTES.

Attribute	Type	Description	Examples
`db.system`	string	experimental Display name: `Database system` An identifier for the database management system (DBMS) product being used. See below for a list of well-known identifiers. ¹	`mongodb`; `mysql`
`deployment.environment`	string	resource deprecated Use deployment.environment.name instead. Display name: `Snowflake deployment environment` Deprecated alias for deployment.environment.name. The deployment environment, for example, production, staging, or development. Will be removed in release 1.3.0. ²	`PROD`
`deployment.environment.name`	string	resource stable Display name: `Snowflake deployment environment name` The deployment environment name (OTel semconv canonical field), for example, production, staging, or development. Emitted alongside deployment.environment during the deprecation window. ³	`PROD`
`deployment.environment.tag`	string	resource stable Display name: `Deployment environment tag` Optional tag for the deployment environment in multitenancy mode ⁴	`SA080`
`dsoa.run.context`	string	resource stable Display name: `Dynatrace Snowflake Observability Agent execution context` The name of the Dynatrace Snowflake Observability Agent context (part of plugin) used to produce the telemetry (logs, traces, metrics, or events). In case of multiple contexts within the same plugin, this helps differentiate between them. If plugin delivers only one context, this field will have the same value as the plugin name. ⁵	`users_all_roles`
`dsoa.run.id`	string	resource stable Display name: `Dynatrace Snowflake Observability Agent execution unique identifier` Unique ID of each execution of the Dynatrace Snowflake Observability Agent plugin. It can be used to differentiate between telemetry produced between two executions, for example, to calculate the change in the system. ⁶	`4aa7c76c-e98c-4b8b-a5b3-a8a721bbde2d`
`dsoa.run.plugin`	string	resource stable Display name: `Dynatrace Snowflake Observability Agent execution plugin name` The name of the Dynatrace Snowflake Observability Agent plugin that produced this telemetry. Use to filter all telemetry from a specific plugin (for example, 'query_history', 'warehouse_usage'). Distinct from dsoa.run.context, which may represent a sub-context within a plugin. ⁷	`users`
`host.name`	string	resource experimental Display name: `Host name` The host name as determined on the data source (for instance, OneAgent, extensions or OpenTelemetry). Important: This is not the name of the host entity, which can be modified based on naming rules. ⁸ Tags: `permission`	`ip-10-178-54-32.ec2.internal`
`service.name`	string	resource stable Display name: `OTel service name` The logical name of the service. ⁹	`shoppingcart`
`telemetry.exporter.name`	string	resource experimental Display name: `Telemetry exporter name` The exporter name. ¹⁰	`odin`
`telemetry.exporter.version`	string	resource experimental Display name: `Telemetry exporter version` The full agent/exporter version. ¹¹	`1.285.1.20240101-256988`

Always 'snowflake' for all Dynatrace Snowflake Observability Agent telemetry.

User-configured deployment environment label, for example, 'PROD', 'STG', or 'DEV'. Set via 'core.snowflake.deployment_environment'.

⁴

Optional user-defined tag for grouping Snowflake accounts in multitenancy mode, set via 'core.tag'.

⁵

Identifies the specific sub-context within the plugin (for example, 'query_history', 'users_all_roles').

⁶

Unique identifier for a single Dynatrace Snowflake Observability Agent execution run. Changes on every invocation.

⁷

The Dynatrace Snowflake Observability Agent plugin that produced this telemetry (for example, 'query_history', 'warehouse_usage').

⁸

The Snowflake account hostname (for example, 'xy12345.snowflakecomputing.com'), from 'core.snowflake.host_name'.

⁹

Always the Snowflake account identifier without '.snowflakecomputing.com' suffix (for example, 'myorg-myaccount').

¹⁰

Always 'dynatrace.snowagent' — identifies Dynatrace Snowflake Observability Agent as the telemetry exporter.

¹¹

The installed Dynatrace Snowflake Observability Agent version in <major>.<minor>.<patch>.<build> format.

db.system has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`adabas`	Adabas (Adaptable Database System)	Adabas
`amazon-documentdb`	Amazon DocumentDB	DocumentDB
`aurora-mysql`	Amazon Aurora MySQL	Aurora MySQL
`aurora-postgresql`	Amazon Aurora PostgreSQL	Aurora PostgreSQL
`cache`	InterSystems Caché	InterSystems Caché
`cassandra`	Apache Cassandra	Cassandra
`clickhouse`	ClickHouse	ClickHouse
`cloudscape`	Cloudscape	Cloudscape
`cockroachdb`	CockroachDB	CockroachDB
`coldfusion`	ColdFusion IMQ	ColdFusion IMQ
`cosmosdb`	Microsoft Azure Cosmos DB	Cosmos DB
`couchbase`	Couchbase	Couchbase
`couchdb`	CouchDB	CouchDB
`databricks`	Databricks Data Platform	Databricks Data Platform
`db2`	IBM Db2	IBM Db2
`derby`	Apache Derby	Derby
`dl/i`	IBM DL/I	IBM DL/I
`dynamodb`	Amazon DynamoDB	DynamoDB
`edb`	EnterpriseDB	EnterpriseDB
`elasticsearch`	Elasticsearch	Elasticsearch
`filemaker`	FileMaker	FileMaker
`firebird`	Firebird	Firebird
`firstsql`	FirstSQL	FirstSQL
`geode`	Apache Geode	Geode
`h2`	H2	H2
`hanadb`	SAP HANA	SAP HANA
`hbase`	Apache HBase	HBase
`hive`	Apache Hive	Hive
`hsqldb`	HyperSQL DataBase	HSQLDB
`informix`	Informix	Informix
`ingres`	Ingres	Ingres
`instantdb`	InstantDB	InstantDB
`interbase`	InterBase	InterBase
`keyspaces-cassandra`	Amazon Keyspaces for Apache Cassandra	Keyspaces
`mariadb`	MariaDB	MariaDB
`maxdb`	SAP MaxDB	SAP MaxDB
`memcached`	Memcached	Memcached
`mongodb`	MongoDB	MongoDB
`mssql`	Microsoft SQL Server	SQL Server
`mssqlcompact`	Microsoft SQL Server Compact	SQL Server Compact
`mysql`	MySQL	MySQL
`neo4j`	Neo4j	Neo4j
`neptune`	Amazon Neptune	Neptune
`netezza`	Netezza	Netezza
`opensearch`	OpenSearch	OpenSearch
`oracle`	Oracle Database	Oracle
`other_sql`	Some other SQL database. Fallback only. See notes.	Other SQL
`pervasive`	Pervasive PSQL	Pervasive PSQL
`phoenix`	Apache Phoenix	Apache Phoenix
`pointbase`	PointBase	PointBase
`postgresql`	PostgreSQL	PostgreSQL
`progress`	Progress Database	Progress
`redis`	Redis	Redis
`redshift`	Amazon Redshift	Redshift
`snowflake`	Snowflake Data Platform	Snowflake Data Platform
`spanner`	Cloud Spanner	Cloud Spanner
`sqlite`	SQLite	SQLite
`sybase`	Sybase	Sybase
`teradata`	Teradata	Teradata
`valkey`	Valkey	Valkey
`vertica`	Vertica	Vertica

Trust Center log record fields

Attribute fields for Trust Center log records.

Attribute	Type	Description	Examples
`snowflake.entity.details`	string	stable Display name: `Snowflake entity details` Additional details about the entity involved in the event.	`Contains user data`
`snowflake.entity.id`	string	experimental Display name: `Snowflake entity ID` The unique identifier for the entity involved in the event.	`entity123`
`snowflake.entity.name`	string	stable Display name: `Snowflake entity name` The name of the entity involved in the event.	`User Table`
`snowflake.entity.type`	string	experimental Display name: `Snowflake entity type` The type of entity involved in the event, such as a table, view, or user.	`table`
`snowflake.trust_center.scanner.description`	string	experimental Display name: `Snowflake Trust Center scanner description` A short description of the scanner used in the Trust Center.	`Ensure monitoring and alerting exist for password sign-in without MFA`
`snowflake.trust_center.scanner.name`	string	experimental Display name: `Snowflake Trust Center scanner name` The name of the scanner used in the Trust Center.	`2.4`
`snowflake.trust_center.scanner.package.name`	string	experimental Display name: `Snowflake Trust Center scanner package name` The name of the scanner package used in the Trust Center.	`CIS Package`

Snowflake active queries log records

Log records emitted by the Dynatrace Snowflake Observability Agent active_queries plugin.

Query

Fetch the 100 most recent Dynatrace Snowflake Observability Agent active_queries plugin log entries from Grail.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "active_queries"
| sort timestamp desc
| limit 100

Fetch the 50 most recent active queries that failed with an error.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "active_queries"
| filter snowflake.query.execution_status == "FAILED_WITH_ERROR"
| sort timestamp desc
| limit 50

Rank warehouses by the average running time of their currently active Snowflake queries.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "active_queries"
| filter isNotNull(snowflake.warehouse.name)
| summarize { count = count(), avg_running_ms = avg(toLong(snowflake.time.running)) }, by: { snowflake.warehouse.name }
| sort avg_running_ms desc
| limit 20

Dynatrace Snowflake Observability Agent resource fields

Fields present on all Dynatrace Snowflake Observability Agent telemetry records. Synced with config.py RESOURCE_ATTRIBUTES.

Attribute	Type	Description	Examples
`db.system`	string	experimental Display name: `Database system` An identifier for the database management system (DBMS) product being used. See below for a list of well-known identifiers. ¹	`mongodb`; `mysql`
`deployment.environment`	string	resource deprecated Use deployment.environment.name instead. Display name: `Snowflake deployment environment` Deprecated alias for deployment.environment.name. The deployment environment, for example, production, staging, or development. Will be removed in release 1.3.0. ²	`PROD`
`deployment.environment.name`	string	resource stable Display name: `Snowflake deployment environment name` The deployment environment name (OTel semconv canonical field), for example, production, staging, or development. Emitted alongside deployment.environment during the deprecation window. ³	`PROD`
`deployment.environment.tag`	string	resource stable Display name: `Deployment environment tag` Optional tag for the deployment environment in multitenancy mode ⁴	`SA080`
`dsoa.run.context`	string	resource stable Display name: `Dynatrace Snowflake Observability Agent execution context` The name of the Dynatrace Snowflake Observability Agent context (part of plugin) used to produce the telemetry (logs, traces, metrics, or events). In case of multiple contexts within the same plugin, this helps differentiate between them. If plugin delivers only one context, this field will have the same value as the plugin name. ⁵	`users_all_roles`
`dsoa.run.id`	string	resource stable Display name: `Dynatrace Snowflake Observability Agent execution unique identifier` Unique ID of each execution of the Dynatrace Snowflake Observability Agent plugin. It can be used to differentiate between telemetry produced between two executions, for example, to calculate the change in the system. ⁶	`4aa7c76c-e98c-4b8b-a5b3-a8a721bbde2d`
`dsoa.run.plugin`	string	resource stable Display name: `Dynatrace Snowflake Observability Agent execution plugin name` The name of the Dynatrace Snowflake Observability Agent plugin that produced this telemetry. Use to filter all telemetry from a specific plugin (for example, 'query_history', 'warehouse_usage'). Distinct from dsoa.run.context, which may represent a sub-context within a plugin. ⁷	`users`
`host.name`	string	resource experimental Display name: `Host name` The host name as determined on the data source (for instance, OneAgent, extensions or OpenTelemetry). Important: This is not the name of the host entity, which can be modified based on naming rules. ⁸ Tags: `permission`	`ip-10-178-54-32.ec2.internal`
`service.name`	string	resource stable Display name: `OTel service name` The logical name of the service. ⁹	`shoppingcart`
`telemetry.exporter.name`	string	resource experimental Display name: `Telemetry exporter name` The exporter name. ¹⁰	`odin`
`telemetry.exporter.version`	string	resource experimental Display name: `Telemetry exporter version` The full agent/exporter version. ¹¹	`1.285.1.20240101-256988`

Always 'snowflake' for all Dynatrace Snowflake Observability Agent telemetry.

User-configured deployment environment label, for example, 'PROD', 'STG', or 'DEV'. Set via 'core.snowflake.deployment_environment'.

⁴

Optional user-defined tag for grouping Snowflake accounts in multitenancy mode, set via 'core.tag'.

⁵

Identifies the specific sub-context within the plugin (for example, 'query_history', 'users_all_roles').

⁶

Unique identifier for a single Dynatrace Snowflake Observability Agent execution run. Changes on every invocation.

⁷

The Dynatrace Snowflake Observability Agent plugin that produced this telemetry (for example, 'query_history', 'warehouse_usage').

⁸

The Snowflake account hostname (for example, 'xy12345.snowflakecomputing.com'), from 'core.snowflake.host_name'.

⁹

Always the Snowflake account identifier without '.snowflakecomputing.com' suffix (for example, 'myorg-myaccount').

¹⁰

Always 'dynatrace.snowagent' — identifies Dynatrace Snowflake Observability Agent as the telemetry exporter.

¹¹

The installed Dynatrace Snowflake Observability Agent version in <major>.<minor>.<patch>.<build> format.

db.system has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`adabas`	Adabas (Adaptable Database System)	Adabas
`amazon-documentdb`	Amazon DocumentDB	DocumentDB
`aurora-mysql`	Amazon Aurora MySQL	Aurora MySQL
`aurora-postgresql`	Amazon Aurora PostgreSQL	Aurora PostgreSQL
`cache`	InterSystems Caché	InterSystems Caché
`cassandra`	Apache Cassandra	Cassandra
`clickhouse`	ClickHouse	ClickHouse
`cloudscape`	Cloudscape	Cloudscape
`cockroachdb`	CockroachDB	CockroachDB
`coldfusion`	ColdFusion IMQ	ColdFusion IMQ
`cosmosdb`	Microsoft Azure Cosmos DB	Cosmos DB
`couchbase`	Couchbase	Couchbase
`couchdb`	CouchDB	CouchDB
`databricks`	Databricks Data Platform	Databricks Data Platform
`db2`	IBM Db2	IBM Db2
`derby`	Apache Derby	Derby
`dl/i`	IBM DL/I	IBM DL/I
`dynamodb`	Amazon DynamoDB	DynamoDB
`edb`	EnterpriseDB	EnterpriseDB
`elasticsearch`	Elasticsearch	Elasticsearch
`filemaker`	FileMaker	FileMaker
`firebird`	Firebird	Firebird
`firstsql`	FirstSQL	FirstSQL
`geode`	Apache Geode	Geode
`h2`	H2	H2
`hanadb`	SAP HANA	SAP HANA
`hbase`	Apache HBase	HBase
`hive`	Apache Hive	Hive
`hsqldb`	HyperSQL DataBase	HSQLDB
`informix`	Informix	Informix
`ingres`	Ingres	Ingres
`instantdb`	InstantDB	InstantDB
`interbase`	InterBase	InterBase
`keyspaces-cassandra`	Amazon Keyspaces for Apache Cassandra	Keyspaces
`mariadb`	MariaDB	MariaDB
`maxdb`	SAP MaxDB	SAP MaxDB
`memcached`	Memcached	Memcached
`mongodb`	MongoDB	MongoDB
`mssql`	Microsoft SQL Server	SQL Server
`mssqlcompact`	Microsoft SQL Server Compact	SQL Server Compact
`mysql`	MySQL	MySQL
`neo4j`	Neo4j	Neo4j
`neptune`	Amazon Neptune	Neptune
`netezza`	Netezza	Netezza
`opensearch`	OpenSearch	OpenSearch
`oracle`	Oracle Database	Oracle
`other_sql`	Some other SQL database. Fallback only. See notes.	Other SQL
`pervasive`	Pervasive PSQL	Pervasive PSQL
`phoenix`	Apache Phoenix	Apache Phoenix
`pointbase`	PointBase	PointBase
`postgresql`	PostgreSQL	PostgreSQL
`progress`	Progress Database	Progress
`redis`	Redis	Redis
`redshift`	Amazon Redshift	Redshift
`snowflake`	Snowflake Data Platform	Snowflake Data Platform
`spanner`	Cloud Spanner	Cloud Spanner
`sqlite`	SQLite	SQLite
`sybase`	Sybase	Sybase
`teradata`	Teradata	Teradata
`valkey`	Valkey	Valkey
`vertica`	Vertica	Vertica

Active queries log record fields

Attribute fields for active queries log records.

Attribute	Type	Description	Examples
`snowflake.error.code`	string	stable Display name: `Snowflake error code` The error code returned by the operation, if any.	`1001`
`snowflake.error.message`	string	stable Display name: `Snowflake error message` The error message returned by the operation, if any.	`Syntax error in SQL statement`
`snowflake.query.hash`	string	stable Display name: `Snowflake query text hash` The hash of the query text.	`hash_abcdef`
`snowflake.query.hash_version`	long	experimental Display name: `Snowflake query hash version` The version of the query hash logic.	`1`
`snowflake.query.id`	string	stable Display name: `Snowflake query ID` The unique identifier for the SQL query.	`b1bbaa7f-8144-4e50-947a-b7e9bf7d62d5`
`snowflake.query.parametrized_hash`	string	stable Display name: `Snowflake parameterized query text hash` The hash value of the parameterized query text.	`param_hash_abcdef`
`snowflake.query.parametrized_hash_version`	long	experimental Display name: `Snowflake parameterized query hash version` The version of the parameterized query hash logic.	`1`
`snowflake.query.tag`	string	stable Display name: `Snowflake query tag` The query tag associated with the operation, if any.	`daily_report`
`snowflake.schema.name`	string	stable Display name: `Snowflake schema name` The name of the schema.	`public`
`snowflake.session.id`	string	experimental Display name: `Snowflake session ID` The unique identifier for the session in which the query was executed. ¹	`123456789`

OTel semconv Development-tier attribute (session namespace). The semdict session.id is model-scoped/internal in code_monitoring only; no global ref available. Emitting as new id: pending global semdict registration.

Snowflake budgets log records

Log records emitted by the Dynatrace Snowflake Observability Agent budgets plugin.

Query

Fetch the 100 most recent Dynatrace Snowflake Observability Agent budgets plugin log entries from Grail.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "budgets"
| sort timestamp desc
| limit 100

Inspect the latest spend and limit readings for each Snowflake budget.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "budgets"
| filter isNotNull(snowflake.budget.name)
| fields timestamp, snowflake.budget.name, snowflake.credits.spent, snowflake.credits.limit
| sort timestamp desc
| limit 50

Rank Snowflake budgets by their most recent credits-spent reading.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "budgets"
| filter isNotNull(snowflake.budget.name)
| summarize { latest_spent = takeMax(toDouble(snowflake.credits.spent)) }, by: { snowflake.budget.name }
| sort latest_spent desc

Dynatrace Snowflake Observability Agent resource fields

Fields present on all Dynatrace Snowflake Observability Agent telemetry records. Synced with config.py RESOURCE_ATTRIBUTES.

Attribute	Type	Description	Examples
`db.system`	string	experimental Display name: `Database system` An identifier for the database management system (DBMS) product being used. See below for a list of well-known identifiers. ¹	`mongodb`; `mysql`
`deployment.environment`	string	resource deprecated Use deployment.environment.name instead. Display name: `Snowflake deployment environment` Deprecated alias for deployment.environment.name. The deployment environment, for example, production, staging, or development. Will be removed in release 1.3.0. ²	`PROD`
`deployment.environment.name`	string	resource stable Display name: `Snowflake deployment environment name` The deployment environment name (OTel semconv canonical field), for example, production, staging, or development. Emitted alongside deployment.environment during the deprecation window. ³	`PROD`
`deployment.environment.tag`	string	resource stable Display name: `Deployment environment tag` Optional tag for the deployment environment in multitenancy mode ⁴	`SA080`
`dsoa.run.context`	string	resource stable Display name: `Dynatrace Snowflake Observability Agent execution context` The name of the Dynatrace Snowflake Observability Agent context (part of plugin) used to produce the telemetry (logs, traces, metrics, or events). In case of multiple contexts within the same plugin, this helps differentiate between them. If plugin delivers only one context, this field will have the same value as the plugin name. ⁵	`users_all_roles`
`dsoa.run.id`	string	resource stable Display name: `Dynatrace Snowflake Observability Agent execution unique identifier` Unique ID of each execution of the Dynatrace Snowflake Observability Agent plugin. It can be used to differentiate between telemetry produced between two executions, for example, to calculate the change in the system. ⁶	`4aa7c76c-e98c-4b8b-a5b3-a8a721bbde2d`
`dsoa.run.plugin`	string	resource stable Display name: `Dynatrace Snowflake Observability Agent execution plugin name` The name of the Dynatrace Snowflake Observability Agent plugin that produced this telemetry. Use to filter all telemetry from a specific plugin (for example, 'query_history', 'warehouse_usage'). Distinct from dsoa.run.context, which may represent a sub-context within a plugin. ⁷	`users`
`host.name`	string	resource experimental Display name: `Host name` The host name as determined on the data source (for instance, OneAgent, extensions or OpenTelemetry). Important: This is not the name of the host entity, which can be modified based on naming rules. ⁸ Tags: `permission`	`ip-10-178-54-32.ec2.internal`
`service.name`	string	resource stable Display name: `OTel service name` The logical name of the service. ⁹	`shoppingcart`
`telemetry.exporter.name`	string	resource experimental Display name: `Telemetry exporter name` The exporter name. ¹⁰	`odin`
`telemetry.exporter.version`	string	resource experimental Display name: `Telemetry exporter version` The full agent/exporter version. ¹¹	`1.285.1.20240101-256988`

Always 'snowflake' for all Dynatrace Snowflake Observability Agent telemetry.

User-configured deployment environment label, for example, 'PROD', 'STG', or 'DEV'. Set via 'core.snowflake.deployment_environment'.

⁴

Optional user-defined tag for grouping Snowflake accounts in multitenancy mode, set via 'core.tag'.

⁵

Identifies the specific sub-context within the plugin (for example, 'query_history', 'users_all_roles').

⁶

Unique identifier for a single Dynatrace Snowflake Observability Agent execution run. Changes on every invocation.

⁷

The Dynatrace Snowflake Observability Agent plugin that produced this telemetry (for example, 'query_history', 'warehouse_usage').

⁸

The Snowflake account hostname (for example, 'xy12345.snowflakecomputing.com'), from 'core.snowflake.host_name'.

⁹

Always the Snowflake account identifier without '.snowflakecomputing.com' suffix (for example, 'myorg-myaccount').

¹⁰

Always 'dynatrace.snowagent' — identifies Dynatrace Snowflake Observability Agent as the telemetry exporter.

¹¹

The installed Dynatrace Snowflake Observability Agent version in <major>.<minor>.<patch>.<build> format.

db.system has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`adabas`	Adabas (Adaptable Database System)	Adabas
`amazon-documentdb`	Amazon DocumentDB	DocumentDB
`aurora-mysql`	Amazon Aurora MySQL	Aurora MySQL
`aurora-postgresql`	Amazon Aurora PostgreSQL	Aurora PostgreSQL
`cache`	InterSystems Caché	InterSystems Caché
`cassandra`	Apache Cassandra	Cassandra
`clickhouse`	ClickHouse	ClickHouse
`cloudscape`	Cloudscape	Cloudscape
`cockroachdb`	CockroachDB	CockroachDB
`coldfusion`	ColdFusion IMQ	ColdFusion IMQ
`cosmosdb`	Microsoft Azure Cosmos DB	Cosmos DB
`couchbase`	Couchbase	Couchbase
`couchdb`	CouchDB	CouchDB
`databricks`	Databricks Data Platform	Databricks Data Platform
`db2`	IBM Db2	IBM Db2
`derby`	Apache Derby	Derby
`dl/i`	IBM DL/I	IBM DL/I
`dynamodb`	Amazon DynamoDB	DynamoDB
`edb`	EnterpriseDB	EnterpriseDB
`elasticsearch`	Elasticsearch	Elasticsearch
`filemaker`	FileMaker	FileMaker
`firebird`	Firebird	Firebird
`firstsql`	FirstSQL	FirstSQL
`geode`	Apache Geode	Geode
`h2`	H2	H2
`hanadb`	SAP HANA	SAP HANA
`hbase`	Apache HBase	HBase
`hive`	Apache Hive	Hive
`hsqldb`	HyperSQL DataBase	HSQLDB
`informix`	Informix	Informix
`ingres`	Ingres	Ingres
`instantdb`	InstantDB	InstantDB
`interbase`	InterBase	InterBase
`keyspaces-cassandra`	Amazon Keyspaces for Apache Cassandra	Keyspaces
`mariadb`	MariaDB	MariaDB
`maxdb`	SAP MaxDB	SAP MaxDB
`memcached`	Memcached	Memcached
`mongodb`	MongoDB	MongoDB
`mssql`	Microsoft SQL Server	SQL Server
`mssqlcompact`	Microsoft SQL Server Compact	SQL Server Compact
`mysql`	MySQL	MySQL
`neo4j`	Neo4j	Neo4j
`neptune`	Amazon Neptune	Neptune
`netezza`	Netezza	Netezza
`opensearch`	OpenSearch	OpenSearch
`oracle`	Oracle Database	Oracle
`other_sql`	Some other SQL database. Fallback only. See notes.	Other SQL
`pervasive`	Pervasive PSQL	Pervasive PSQL
`phoenix`	Apache Phoenix	Apache Phoenix
`pointbase`	PointBase	PointBase
`postgresql`	PostgreSQL	PostgreSQL
`progress`	Progress Database	Progress
`redis`	Redis	Redis
`redshift`	Amazon Redshift	Redshift
`snowflake`	Snowflake Data Platform	Snowflake Data Platform
`spanner`	Cloud Spanner	Cloud Spanner
`sqlite`	SQLite	SQLite
`sybase`	Sybase	Sybase
`teradata`	Teradata	Teradata
`valkey`	Valkey	Valkey
`vertica`	Vertica	Vertica

Budgets log record fields

Attribute fields for budgets log records.

Attribute	Type	Description	Examples
`snowflake.budget.owner.name`	string	stable Display name: `Snowflake budget owner name` The owner of the budget, typically the user or role responsible for managing the budget.	`budget_admin`
`snowflake.budget.owner.role_type`	string	experimental Display name: `Snowflake budget owner role type` The principal type of the budget owner: ROLE or APPLICATION.	`ROLE`
`snowflake.budget.resource`	string[]	stable Display name: `Snowflake budget resource` The resources linked to the budget, such as databases, warehouses, or other Snowflake objects that the budget monitors. ¹	`['DATABASE1', 'WAREHOUSE1']`

Array of resource names (databases, warehouses) in this budget group, stored as string[] in Grail.

Snowflake cold tables log records

Log records emitted by the Dynatrace Snowflake Observability Agent cold_tables plugin.

Query

Fetch the 100 most recent Dynatrace Snowflake Observability Agent cold_tables plugin log entries from Grail.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "cold_tables"
| sort timestamp desc
| limit 100

Fetch the 50 most recent tables classified as COLD by the cold_tables plugin.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "cold_tables"
| filter snowflake.table.cold_status == "COLD"
| sort timestamp desc
| limit 50

Rank Snowflake tables by how long they have been idle.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "cold_tables"
| filter isNotNull(snowflake.table.full_name)
| summarize { idle_days = takeMax(toLong(snowflake.table.days_since_last_access)) }, by: { snowflake.table.full_name }
| sort idle_days desc
| limit 25

Dynatrace Snowflake Observability Agent resource fields

Fields present on all Dynatrace Snowflake Observability Agent telemetry records. Synced with config.py RESOURCE_ATTRIBUTES.

Attribute	Type	Description	Examples
`db.system`	string	experimental Display name: `Database system` An identifier for the database management system (DBMS) product being used. See below for a list of well-known identifiers. ¹	`mongodb`; `mysql`
`deployment.environment`	string	resource deprecated Use deployment.environment.name instead. Display name: `Snowflake deployment environment` Deprecated alias for deployment.environment.name. The deployment environment, for example, production, staging, or development. Will be removed in release 1.3.0. ²	`PROD`
`deployment.environment.name`	string	resource stable Display name: `Snowflake deployment environment name` The deployment environment name (OTel semconv canonical field), for example, production, staging, or development. Emitted alongside deployment.environment during the deprecation window. ³	`PROD`
`deployment.environment.tag`	string	resource stable Display name: `Deployment environment tag` Optional tag for the deployment environment in multitenancy mode ⁴	`SA080`
`dsoa.run.context`	string	resource stable Display name: `Dynatrace Snowflake Observability Agent execution context` The name of the Dynatrace Snowflake Observability Agent context (part of plugin) used to produce the telemetry (logs, traces, metrics, or events). In case of multiple contexts within the same plugin, this helps differentiate between them. If plugin delivers only one context, this field will have the same value as the plugin name. ⁵	`users_all_roles`
`dsoa.run.id`	string	resource stable Display name: `Dynatrace Snowflake Observability Agent execution unique identifier` Unique ID of each execution of the Dynatrace Snowflake Observability Agent plugin. It can be used to differentiate between telemetry produced between two executions, for example, to calculate the change in the system. ⁶	`4aa7c76c-e98c-4b8b-a5b3-a8a721bbde2d`
`dsoa.run.plugin`	string	resource stable Display name: `Dynatrace Snowflake Observability Agent execution plugin name` The name of the Dynatrace Snowflake Observability Agent plugin that produced this telemetry. Use to filter all telemetry from a specific plugin (for example, 'query_history', 'warehouse_usage'). Distinct from dsoa.run.context, which may represent a sub-context within a plugin. ⁷	`users`
`host.name`	string	resource experimental Display name: `Host name` The host name as determined on the data source (for instance, OneAgent, extensions or OpenTelemetry). Important: This is not the name of the host entity, which can be modified based on naming rules. ⁸ Tags: `permission`	`ip-10-178-54-32.ec2.internal`
`service.name`	string	resource stable Display name: `OTel service name` The logical name of the service. ⁹	`shoppingcart`
`telemetry.exporter.name`	string	resource experimental Display name: `Telemetry exporter name` The exporter name. ¹⁰	`odin`
`telemetry.exporter.version`	string	resource experimental Display name: `Telemetry exporter version` The full agent/exporter version. ¹¹	`1.285.1.20240101-256988`

Always 'snowflake' for all Dynatrace Snowflake Observability Agent telemetry.

User-configured deployment environment label, for example, 'PROD', 'STG', or 'DEV'. Set via 'core.snowflake.deployment_environment'.

⁴

Optional user-defined tag for grouping Snowflake accounts in multitenancy mode, set via 'core.tag'.

⁵

Identifies the specific sub-context within the plugin (for example, 'query_history', 'users_all_roles').

⁶

Unique identifier for a single Dynatrace Snowflake Observability Agent execution run. Changes on every invocation.

⁷

The Dynatrace Snowflake Observability Agent plugin that produced this telemetry (for example, 'query_history', 'warehouse_usage').

⁸

The Snowflake account hostname (for example, 'xy12345.snowflakecomputing.com'), from 'core.snowflake.host_name'.

⁹

Always the Snowflake account identifier without '.snowflakecomputing.com' suffix (for example, 'myorg-myaccount').

¹⁰

Always 'dynatrace.snowagent' — identifies Dynatrace Snowflake Observability Agent as the telemetry exporter.

¹¹

The installed Dynatrace Snowflake Observability Agent version in <major>.<minor>.<patch>.<build> format.

db.system has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`adabas`	Adabas (Adaptable Database System)	Adabas
`amazon-documentdb`	Amazon DocumentDB	DocumentDB
`aurora-mysql`	Amazon Aurora MySQL	Aurora MySQL
`aurora-postgresql`	Amazon Aurora PostgreSQL	Aurora PostgreSQL
`cache`	InterSystems Caché	InterSystems Caché
`cassandra`	Apache Cassandra	Cassandra
`clickhouse`	ClickHouse	ClickHouse
`cloudscape`	Cloudscape	Cloudscape
`cockroachdb`	CockroachDB	CockroachDB
`coldfusion`	ColdFusion IMQ	ColdFusion IMQ
`cosmosdb`	Microsoft Azure Cosmos DB	Cosmos DB
`couchbase`	Couchbase	Couchbase
`couchdb`	CouchDB	CouchDB
`databricks`	Databricks Data Platform	Databricks Data Platform
`db2`	IBM Db2	IBM Db2
`derby`	Apache Derby	Derby
`dl/i`	IBM DL/I	IBM DL/I
`dynamodb`	Amazon DynamoDB	DynamoDB
`edb`	EnterpriseDB	EnterpriseDB
`elasticsearch`	Elasticsearch	Elasticsearch
`filemaker`	FileMaker	FileMaker
`firebird`	Firebird	Firebird
`firstsql`	FirstSQL	FirstSQL
`geode`	Apache Geode	Geode
`h2`	H2	H2
`hanadb`	SAP HANA	SAP HANA
`hbase`	Apache HBase	HBase
`hive`	Apache Hive	Hive
`hsqldb`	HyperSQL DataBase	HSQLDB
`informix`	Informix	Informix
`ingres`	Ingres	Ingres
`instantdb`	InstantDB	InstantDB
`interbase`	InterBase	InterBase
`keyspaces-cassandra`	Amazon Keyspaces for Apache Cassandra	Keyspaces
`mariadb`	MariaDB	MariaDB
`maxdb`	SAP MaxDB	SAP MaxDB
`memcached`	Memcached	Memcached
`mongodb`	MongoDB	MongoDB
`mssql`	Microsoft SQL Server	SQL Server
`mssqlcompact`	Microsoft SQL Server Compact	SQL Server Compact
`mysql`	MySQL	MySQL
`neo4j`	Neo4j	Neo4j
`neptune`	Amazon Neptune	Neptune
`netezza`	Netezza	Netezza
`opensearch`	OpenSearch	OpenSearch
`oracle`	Oracle Database	Oracle
`other_sql`	Some other SQL database. Fallback only. See notes.	Other SQL
`pervasive`	Pervasive PSQL	Pervasive PSQL
`phoenix`	Apache Phoenix	Apache Phoenix
`pointbase`	PointBase	PointBase
`postgresql`	PostgreSQL	PostgreSQL
`progress`	Progress Database	Progress
`redis`	Redis	Redis
`redshift`	Amazon Redshift	Redshift
`snowflake`	Snowflake Data Platform	Snowflake Data Platform
`spanner`	Cloud Spanner	Cloud Spanner
`sqlite`	SQLite	SQLite
`sybase`	Sybase	Sybase
`teradata`	Teradata	Teradata
`valkey`	Valkey	Valkey
`vertica`	Vertica	Vertica

Cold tables log record fields

Attribute fields for cold tables log records.

Attribute	Type	Description	Examples
`snowflake.table.last_accessed_at`	string	experimental Display name: `Snowflake table last access time` ISO 8601 timestamp of the most recent query that accessed this table.	`2026-01-15T10:30:00Z`

Snowflake data schemas log records

Log records emitted by the Dynatrace Snowflake Observability Agent data_schemas plugin.

Query

Fetch the 100 most recent Dynatrace Snowflake Observability Agent data_schemas plugin log entries (DDL change inventory) from Grail.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "data_schemas"
| sort timestamp desc
| limit 100

Fetch the 50 most recent DROP DDL operations reported by the data_schemas plugin.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "data_schemas"
| filter snowflake.object.ddl.operation == "DROP"
| sort timestamp desc
| limit 50

Fetch the 50 most recent DDL changes affecting Snowflake tables.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "data_schemas"
| filter snowflake.object.type == "Table"
| sort timestamp desc
| limit 50

Dynatrace Snowflake Observability Agent resource fields

Fields present on all Dynatrace Snowflake Observability Agent telemetry records. Synced with config.py RESOURCE_ATTRIBUTES.

Attribute	Type	Description	Examples
`db.system`	string	experimental Display name: `Database system` An identifier for the database management system (DBMS) product being used. See below for a list of well-known identifiers. ¹	`mongodb`; `mysql`
`deployment.environment`	string	resource deprecated Use deployment.environment.name instead. Display name: `Snowflake deployment environment` Deprecated alias for deployment.environment.name. The deployment environment, for example, production, staging, or development. Will be removed in release 1.3.0. ²	`PROD`
`deployment.environment.name`	string	resource stable Display name: `Snowflake deployment environment name` The deployment environment name (OTel semconv canonical field), for example, production, staging, or development. Emitted alongside deployment.environment during the deprecation window. ³	`PROD`
`deployment.environment.tag`	string	resource stable Display name: `Deployment environment tag` Optional tag for the deployment environment in multitenancy mode ⁴	`SA080`
`dsoa.run.context`	string	resource stable Display name: `Dynatrace Snowflake Observability Agent execution context` The name of the Dynatrace Snowflake Observability Agent context (part of plugin) used to produce the telemetry (logs, traces, metrics, or events). In case of multiple contexts within the same plugin, this helps differentiate between them. If plugin delivers only one context, this field will have the same value as the plugin name. ⁵	`users_all_roles`
`dsoa.run.id`	string	resource stable Display name: `Dynatrace Snowflake Observability Agent execution unique identifier` Unique ID of each execution of the Dynatrace Snowflake Observability Agent plugin. It can be used to differentiate between telemetry produced between two executions, for example, to calculate the change in the system. ⁶	`4aa7c76c-e98c-4b8b-a5b3-a8a721bbde2d`
`dsoa.run.plugin`	string	resource stable Display name: `Dynatrace Snowflake Observability Agent execution plugin name` The name of the Dynatrace Snowflake Observability Agent plugin that produced this telemetry. Use to filter all telemetry from a specific plugin (for example, 'query_history', 'warehouse_usage'). Distinct from dsoa.run.context, which may represent a sub-context within a plugin. ⁷	`users`
`host.name`	string	resource experimental Display name: `Host name` The host name as determined on the data source (for instance, OneAgent, extensions or OpenTelemetry). Important: This is not the name of the host entity, which can be modified based on naming rules. ⁸ Tags: `permission`	`ip-10-178-54-32.ec2.internal`
`service.name`	string	resource stable Display name: `OTel service name` The logical name of the service. ⁹	`shoppingcart`
`telemetry.exporter.name`	string	resource experimental Display name: `Telemetry exporter name` The exporter name. ¹⁰	`odin`
`telemetry.exporter.version`	string	resource experimental Display name: `Telemetry exporter version` The full agent/exporter version. ¹¹	`1.285.1.20240101-256988`

Always 'snowflake' for all Dynatrace Snowflake Observability Agent telemetry.

User-configured deployment environment label, for example, 'PROD', 'STG', or 'DEV'. Set via 'core.snowflake.deployment_environment'.

⁴

Optional user-defined tag for grouping Snowflake accounts in multitenancy mode, set via 'core.tag'.

⁵

Identifies the specific sub-context within the plugin (for example, 'query_history', 'users_all_roles').

⁶

Unique identifier for a single Dynatrace Snowflake Observability Agent execution run. Changes on every invocation.

⁷

The Dynatrace Snowflake Observability Agent plugin that produced this telemetry (for example, 'query_history', 'warehouse_usage').

⁸

The Snowflake account hostname (for example, 'xy12345.snowflakecomputing.com'), from 'core.snowflake.host_name'.

⁹

Always the Snowflake account identifier without '.snowflakecomputing.com' suffix (for example, 'myorg-myaccount').

¹⁰

Always 'dynatrace.snowagent' — identifies Dynatrace Snowflake Observability Agent as the telemetry exporter.

¹¹

The installed Dynatrace Snowflake Observability Agent version in <major>.<minor>.<patch>.<build> format.

db.system has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`adabas`	Adabas (Adaptable Database System)	Adabas
`amazon-documentdb`	Amazon DocumentDB	DocumentDB
`aurora-mysql`	Amazon Aurora MySQL	Aurora MySQL
`aurora-postgresql`	Amazon Aurora PostgreSQL	Aurora PostgreSQL
`cache`	InterSystems Caché	InterSystems Caché
`cassandra`	Apache Cassandra	Cassandra
`clickhouse`	ClickHouse	ClickHouse
`cloudscape`	Cloudscape	Cloudscape
`cockroachdb`	CockroachDB	CockroachDB
`coldfusion`	ColdFusion IMQ	ColdFusion IMQ
`cosmosdb`	Microsoft Azure Cosmos DB	Cosmos DB
`couchbase`	Couchbase	Couchbase
`couchdb`	CouchDB	CouchDB
`databricks`	Databricks Data Platform	Databricks Data Platform
`db2`	IBM Db2	IBM Db2
`derby`	Apache Derby	Derby
`dl/i`	IBM DL/I	IBM DL/I
`dynamodb`	Amazon DynamoDB	DynamoDB
`edb`	EnterpriseDB	EnterpriseDB
`elasticsearch`	Elasticsearch	Elasticsearch
`filemaker`	FileMaker	FileMaker
`firebird`	Firebird	Firebird
`firstsql`	FirstSQL	FirstSQL
`geode`	Apache Geode	Geode
`h2`	H2	H2
`hanadb`	SAP HANA	SAP HANA
`hbase`	Apache HBase	HBase
`hive`	Apache Hive	Hive
`hsqldb`	HyperSQL DataBase	HSQLDB
`informix`	Informix	Informix
`ingres`	Ingres	Ingres
`instantdb`	InstantDB	InstantDB
`interbase`	InterBase	InterBase
`keyspaces-cassandra`	Amazon Keyspaces for Apache Cassandra	Keyspaces
`mariadb`	MariaDB	MariaDB
`maxdb`	SAP MaxDB	SAP MaxDB
`memcached`	Memcached	Memcached
`mongodb`	MongoDB	MongoDB
`mssql`	Microsoft SQL Server	SQL Server
`mssqlcompact`	Microsoft SQL Server Compact	SQL Server Compact
`mysql`	MySQL	MySQL
`neo4j`	Neo4j	Neo4j
`neptune`	Amazon Neptune	Neptune
`netezza`	Netezza	Netezza
`opensearch`	OpenSearch	OpenSearch
`oracle`	Oracle Database	Oracle
`other_sql`	Some other SQL database. Fallback only. See notes.	Other SQL
`pervasive`	Pervasive PSQL	Pervasive PSQL
`phoenix`	Apache Phoenix	Apache Phoenix
`pointbase`	PointBase	PointBase
`postgresql`	PostgreSQL	PostgreSQL
`progress`	Progress Database	Progress
`redis`	Redis	Redis
`redshift`	Amazon Redshift	Redshift
`snowflake`	Snowflake Data Platform	Snowflake Data Platform
`spanner`	Cloud Spanner	Cloud Spanner
`sqlite`	SQLite	SQLite
`sybase`	Sybase	Sybase
`teradata`	Teradata	Teradata
`valkey`	Valkey	Valkey
`vertica`	Vertica	Vertica

Data schemas log record fields

Attribute fields for data schemas log records.

Attribute	Type	Description	Examples
`snowflake.object.ddl.modified`	string	experimental Display name: `Snowflake DDL-modified object details` A JSON array that specifies the objects that were associated with a write operation in the query. ¹	`{ "DTAGENT_DB.APP.TMP_RECENT_QUERIES": { "objectColumns": "HISTOGRAM_METRICS, COUNTER_METRICS, START_TIME, STATUS_CODE, SESSION_ID, QUERY_ID, DIMENSIONS, END_TIME, NAME, ATTRIBUTES, PARENT_QUERY_ID", "objectDomain": "Table" } }`
`snowflake.object.ddl.operation`	string	stable Display name: `Snowflake DDL operation` The SQL keyword that specifies the operation on the table, view, or column.	`REPLACE`
`snowflake.object.ddl.properties`	string	stable Display name: `Snowflake DDL property changes` A JSON array that specifies the object or column properties when you create, modify, drop, or undrop the object or column. There are two types of properties: atomic and compound. ²	`{"creationMode": "CREATE", "columns": {"ADD": ["ATTRIBUTE","JOB_ID"]}}`
`snowflake.object.id`	long	stable Display name: `Snowflake object ID` An identifier for the object, which is unique within a given account and domain.	`747545`
`snowflake.object.name`	string	stable Display name: `Snowflake object name` The fully qualified name of the object defined or modified by the DDL operation.	`DTAGENT_DB.APP.TMP_RECENT_QUERIES`
`snowflake.object.type`	string	stable Display name: `Snowflake object type` The domain of the object defined or modified by the DDL operation.	`Table`
`snowflake.query.parent_id`	string	stable Display name: `Snowflake parent query ID` The query ID of the parent job or NULL if the job does not have a parent.	`01b2fd01-0604-6864-0040-e003029abda2`
`snowflake.query.root_id`	string	experimental Display name: `Snowflake root query ID` The query ID of the top most job in the chain or NULL if the job does not have a parent.	`01b2fd00-0604-6864-0040-e003029abd82`

Serialized JSON object stored as string in Grail. Contains modified DDL object details. Parse with parseJson() in DQL.

Stored as a serialized JSON string, not plain text.

Snowflake dynamic tables log records

Log records emitted by the Dynatrace Snowflake Observability Agent dynamic_tables plugin.

Query

Fetch the 100 most recent Dynatrace Snowflake Observability Agent dynamic_tables plugin log entries from Grail.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "dynamic_tables"
| sort timestamp desc
| limit 100

Fetch dynamic table refreshes that missed their target lag (within-ratio below 1.0).

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "dynamic_tables"
| filter toDouble(snowflake.table.dynamic.lag.target.within_ratio) < 1.0
| sort timestamp desc
| limit 50

Rank dynamic tables by their maximum observed refresh lag.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "dynamic_tables"
| filter isNotNull(snowflake.table.full_name)
| summarize { max_lag = takeMax(toLong(snowflake.table.dynamic.lag.max)) }, by: { snowflake.table.full_name }
| sort max_lag desc
| limit 25

Dynatrace Snowflake Observability Agent resource fields

Fields present on all Dynatrace Snowflake Observability Agent telemetry records. Synced with config.py RESOURCE_ATTRIBUTES.

Attribute	Type	Description	Examples
`db.system`	string	experimental Display name: `Database system` An identifier for the database management system (DBMS) product being used. See below for a list of well-known identifiers. ¹	`mongodb`; `mysql`
`deployment.environment`	string	resource deprecated Use deployment.environment.name instead. Display name: `Snowflake deployment environment` Deprecated alias for deployment.environment.name. The deployment environment, for example, production, staging, or development. Will be removed in release 1.3.0. ²	`PROD`
`deployment.environment.name`	string	resource stable Display name: `Snowflake deployment environment name` The deployment environment name (OTel semconv canonical field), for example, production, staging, or development. Emitted alongside deployment.environment during the deprecation window. ³	`PROD`
`deployment.environment.tag`	string	resource stable Display name: `Deployment environment tag` Optional tag for the deployment environment in multitenancy mode ⁴	`SA080`
`dsoa.run.context`	string	resource stable Display name: `Dynatrace Snowflake Observability Agent execution context` The name of the Dynatrace Snowflake Observability Agent context (part of plugin) used to produce the telemetry (logs, traces, metrics, or events). In case of multiple contexts within the same plugin, this helps differentiate between them. If plugin delivers only one context, this field will have the same value as the plugin name. ⁵	`users_all_roles`
`dsoa.run.id`	string	resource stable Display name: `Dynatrace Snowflake Observability Agent execution unique identifier` Unique ID of each execution of the Dynatrace Snowflake Observability Agent plugin. It can be used to differentiate between telemetry produced between two executions, for example, to calculate the change in the system. ⁶	`4aa7c76c-e98c-4b8b-a5b3-a8a721bbde2d`
`dsoa.run.plugin`	string	resource stable Display name: `Dynatrace Snowflake Observability Agent execution plugin name` The name of the Dynatrace Snowflake Observability Agent plugin that produced this telemetry. Use to filter all telemetry from a specific plugin (for example, 'query_history', 'warehouse_usage'). Distinct from dsoa.run.context, which may represent a sub-context within a plugin. ⁷	`users`
`host.name`	string	resource experimental Display name: `Host name` The host name as determined on the data source (for instance, OneAgent, extensions or OpenTelemetry). Important: This is not the name of the host entity, which can be modified based on naming rules. ⁸ Tags: `permission`	`ip-10-178-54-32.ec2.internal`
`service.name`	string	resource stable Display name: `OTel service name` The logical name of the service. ⁹	`shoppingcart`
`telemetry.exporter.name`	string	resource experimental Display name: `Telemetry exporter name` The exporter name. ¹⁰	`odin`
`telemetry.exporter.version`	string	resource experimental Display name: `Telemetry exporter version` The full agent/exporter version. ¹¹	`1.285.1.20240101-256988`

Always 'snowflake' for all Dynatrace Snowflake Observability Agent telemetry.

User-configured deployment environment label, for example, 'PROD', 'STG', or 'DEV'. Set via 'core.snowflake.deployment_environment'.

⁴

Optional user-defined tag for grouping Snowflake accounts in multitenancy mode, set via 'core.tag'.

⁵

Identifies the specific sub-context within the plugin (for example, 'query_history', 'users_all_roles').

⁶

Unique identifier for a single Dynatrace Snowflake Observability Agent execution run. Changes on every invocation.

⁷

The Dynatrace Snowflake Observability Agent plugin that produced this telemetry (for example, 'query_history', 'warehouse_usage').

⁸

The Snowflake account hostname (for example, 'xy12345.snowflakecomputing.com'), from 'core.snowflake.host_name'.

⁹

Always the Snowflake account identifier without '.snowflakecomputing.com' suffix (for example, 'myorg-myaccount').

¹⁰

Always 'dynatrace.snowagent' — identifies Dynatrace Snowflake Observability Agent as the telemetry exporter.

¹¹

The installed Dynatrace Snowflake Observability Agent version in <major>.<minor>.<patch>.<build> format.

db.system has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`adabas`	Adabas (Adaptable Database System)	Adabas
`amazon-documentdb`	Amazon DocumentDB	DocumentDB
`aurora-mysql`	Amazon Aurora MySQL	Aurora MySQL
`aurora-postgresql`	Amazon Aurora PostgreSQL	Aurora PostgreSQL
`cache`	InterSystems Caché	InterSystems Caché
`cassandra`	Apache Cassandra	Cassandra
`clickhouse`	ClickHouse	ClickHouse
`cloudscape`	Cloudscape	Cloudscape
`cockroachdb`	CockroachDB	CockroachDB
`coldfusion`	ColdFusion IMQ	ColdFusion IMQ
`cosmosdb`	Microsoft Azure Cosmos DB	Cosmos DB
`couchbase`	Couchbase	Couchbase
`couchdb`	CouchDB	CouchDB
`databricks`	Databricks Data Platform	Databricks Data Platform
`db2`	IBM Db2	IBM Db2
`derby`	Apache Derby	Derby
`dl/i`	IBM DL/I	IBM DL/I
`dynamodb`	Amazon DynamoDB	DynamoDB
`edb`	EnterpriseDB	EnterpriseDB
`elasticsearch`	Elasticsearch	Elasticsearch
`filemaker`	FileMaker	FileMaker
`firebird`	Firebird	Firebird
`firstsql`	FirstSQL	FirstSQL
`geode`	Apache Geode	Geode
`h2`	H2	H2
`hanadb`	SAP HANA	SAP HANA
`hbase`	Apache HBase	HBase
`hive`	Apache Hive	Hive
`hsqldb`	HyperSQL DataBase	HSQLDB
`informix`	Informix	Informix
`ingres`	Ingres	Ingres
`instantdb`	InstantDB	InstantDB
`interbase`	InterBase	InterBase
`keyspaces-cassandra`	Amazon Keyspaces for Apache Cassandra	Keyspaces
`mariadb`	MariaDB	MariaDB
`maxdb`	SAP MaxDB	SAP MaxDB
`memcached`	Memcached	Memcached
`mongodb`	MongoDB	MongoDB
`mssql`	Microsoft SQL Server	SQL Server
`mssqlcompact`	Microsoft SQL Server Compact	SQL Server Compact
`mysql`	MySQL	MySQL
`neo4j`	Neo4j	Neo4j
`neptune`	Amazon Neptune	Neptune
`netezza`	Netezza	Netezza
`opensearch`	OpenSearch	OpenSearch
`oracle`	Oracle Database	Oracle
`other_sql`	Some other SQL database. Fallback only. See notes.	Other SQL
`pervasive`	Pervasive PSQL	Pervasive PSQL
`phoenix`	Apache Phoenix	Apache Phoenix
`pointbase`	PointBase	PointBase
`postgresql`	PostgreSQL	PostgreSQL
`progress`	Progress Database	Progress
`redis`	Redis	Redis
`redshift`	Amazon Redshift	Redshift
`snowflake`	Snowflake Data Platform	Snowflake Data Platform
`spanner`	Cloud Spanner	Cloud Spanner
`sqlite`	SQLite	SQLite
`sybase`	Sybase	Sybase
`teradata`	Teradata	Teradata
`valkey`	Valkey	Valkey
`vertica`	Vertica	Vertica

Dynamic tables log record fields

Attribute fields for dynamic tables log records.

Attribute	Type	Description	Examples
`snowflake.table.dynamic.graph.alter_trigger`	string[]	experimental Display name: `Snowflake dynamic table graph alter trigger` Describes why a new entry is created in the DYNAMIC_TABLE_GRAPH_HISTORY function. ¹	`['NONE']`; `['CREATE_DYNAMIC_TABLE']`; `['ALTER_TARGET_LAG']`; `['SUSPEND']`; `['RESUME']`; `['REPLICATION_REFRESH']`; `['ALTER_WAREHOUSE']`
`snowflake.table.dynamic.graph.inputs`	string[]	experimental Display name: `Snowflake dynamic table graph inputs` Each OBJECT represents a table, view, or dynamic table that serves as the input to this dynamic table. ²	`['{"kind": "TABLE", "name": "DYNAMIC_TABLE_DB.DYNAMIC_TABLE_SCH.EMPLOYEE"}', '{"kind": "TABLE", "name": "DYNAMIC_TABLE_DB.DYNAMIC_TABLE_SCH.EMPLOYEE_SKILL"}']`
`snowflake.table.dynamic.graph.valid_to`	long	experimental Display name: `Snowflake dynamic table graph validity end time` If present, the description of the dynamic table is valid up to this time. If null, the description is still accurate.	`1733011200000000000`
`snowflake.table.dynamic.lag.target.type`	string	experimental Display name: `Snowflake dynamic table target lag type` The type of target lag.	`USER_DEFINED`
`snowflake.table.dynamic.latest.code`	string	experimental Display name: `Snowflake dynamic table refresh state code (latest)` Code representing the current state of the refresh. If the LAST_COMPLETED_REFRESH_STATE is FAILED, this column shows the error code associated with the failure.	`SUCCESS`
`snowflake.table.dynamic.latest.data_timestamp`	string	experimental Display name: `Snowflake dynamic table refresh timestamp (latest)` Data timestamp of the last successful refresh. ³	`2024-11-22 12:55:29.695 Z`
`snowflake.table.dynamic.latest.dependency.data_timestamp`	string	experimental Display name: `Snowflake dynamic table dependency data timestamp (latest)` Data timestamp of the latest dependency to become available. ³	`2024-11-25 06:09:53.695 Z`
`snowflake.table.dynamic.latest.dependency.name`	string	experimental Display name: `Snowflake dynamic table dependency name (latest)` Qualified name of the latest dependency to become available.	`DYNAMIC_TABLE_DB.DYNAMIC_TABLE_SCH.EMPLOYEE`
`snowflake.table.dynamic.latest.message`	string	experimental Display name: `Snowflake dynamic table refresh message (latest)` Description of the current state of the refresh. If the LAST_COMPLETED_REFRESH_STATE is FAILED, this column shows the error message associated with the failure.	`Refresh completed successfully`
`snowflake.table.dynamic.latest.state`	string	experimental Display name: `Snowflake dynamic table refresh state (latest)` Status of the last terminated refresh for the dynamic table.	`SUCCEEDED`
`snowflake.table.dynamic.refresh.action`	string	stable Display name: `Snowflake dynamic table refresh action` Describes the type of refresh action performed.	`NO_DATA`
`snowflake.table.dynamic.refresh.code`	string	stable Display name: `Snowflake dynamic table refresh state code` Code representing the current state of the refresh.	`SUCCESS`
`snowflake.table.dynamic.refresh.completion_target`	long	experimental Display name: `Snowflake dynamic table refresh completion target time` Time by which this refresh should complete to keep lag under the TARGET_LAG parameter for the dynamic table.	`1732515005695000000`
`snowflake.table.dynamic.refresh.data_timestamp`	long	experimental Display name: `Snowflake dynamic table refresh data timestamp` Transactional timestamp when the refresh was evaluated.	`1732514993695000000`
`snowflake.table.dynamic.refresh.end`	long	experimental Display name: `Snowflake dynamic table refresh end time` Time when the refresh completed.	`1732514995308000000`
`snowflake.table.dynamic.refresh.message`	string	stable Display name: `Snowflake dynamic table refresh message` Description of the current state of the refresh.	`Refresh completed successfully`
`snowflake.table.dynamic.refresh.start`	long	experimental Display name: `Snowflake dynamic table refresh start time` Time when the refresh job started.	`1732514994978000000`
`snowflake.table.dynamic.refresh.state`	string	stable Display name: `Snowflake dynamic table refresh state` Status of the refresh for the dynamic table.	`SUCCEEDED`
`snowflake.table.dynamic.refresh.trigger`	string	stable Display name: `Snowflake dynamic table refresh trigger` Describes the trigger for the refresh.	`SCHEDULED`
`snowflake.table.dynamic.scheduling.reason.code`	string	experimental Display name: `Snowflake dynamic table scheduling reason code` Optional reason code if the state is not ACTIVE.	`MAINTENANCE`
`snowflake.table.dynamic.scheduling.reason.message`	string	experimental Display name: `Snowflake dynamic table scheduling reason message` Text description of the reason the dynamic table is not active. Only applies if the state is not active.	`Scheduled maintenance`
`snowflake.table.dynamic.scheduling.state`	string	stable Display name: `Snowflake dynamic table scheduling state` Scheduling state of the dynamic table.	`ACTIVE`

Array of DDL operation names stored as string[] in Grail (for example, CREATE_DYNAMIC_TABLE).

Array of input table references stored as string[] in Grail. Each element is a JSON-serialized object with kind and name fields.

ISO 8601 timestamp string stored as string in Grail.

Log records emitted by the Dynatrace Snowflake Observability Agent login_history plugin.

Query

Fetch the 100 most recent Dynatrace Snowflake Observability Agent login_history plugin log entries from Grail.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "login_history"
| sort timestamp desc
| limit 100

Fetch failed Snowflake logins with their authentication type and error details.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "login_history"
| filter isNotNull(snowflake.error.code)
| fields timestamp, db.user, authentication.type, snowflake.error.code, snowflake.status.message
| sort timestamp desc
| limit 50

Rank source IP and user combinations by Snowflake login attempt volume.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "login_history"
| filter isNotNull(client.ip)
| summarize { attempts = count() }, by: { client.ip, db.user }
| sort attempts desc
| limit 25

Dynatrace Snowflake Observability Agent resource fields

Fields present on all Dynatrace Snowflake Observability Agent telemetry records. Synced with config.py RESOURCE_ATTRIBUTES.

Attribute	Type	Description	Examples
`db.system`	string	experimental Display name: `Database system` An identifier for the database management system (DBMS) product being used. See below for a list of well-known identifiers. ¹	`mongodb`; `mysql`
`deployment.environment`	string	resource deprecated Use deployment.environment.name instead. Display name: `Snowflake deployment environment` Deprecated alias for deployment.environment.name. The deployment environment, for example, production, staging, or development. Will be removed in release 1.3.0. ²	`PROD`
`deployment.environment.name`	string	resource stable Display name: `Snowflake deployment environment name` The deployment environment name (OTel semconv canonical field), for example, production, staging, or development. Emitted alongside deployment.environment during the deprecation window. ³	`PROD`
`deployment.environment.tag`	string	resource stable Display name: `Deployment environment tag` Optional tag for the deployment environment in multitenancy mode ⁴	`SA080`
`dsoa.run.context`	string	resource stable Display name: `Dynatrace Snowflake Observability Agent execution context` The name of the Dynatrace Snowflake Observability Agent context (part of plugin) used to produce the telemetry (logs, traces, metrics, or events). In case of multiple contexts within the same plugin, this helps differentiate between them. If plugin delivers only one context, this field will have the same value as the plugin name. ⁵	`users_all_roles`
`dsoa.run.id`	string	resource stable Display name: `Dynatrace Snowflake Observability Agent execution unique identifier` Unique ID of each execution of the Dynatrace Snowflake Observability Agent plugin. It can be used to differentiate between telemetry produced between two executions, for example, to calculate the change in the system. ⁶	`4aa7c76c-e98c-4b8b-a5b3-a8a721bbde2d`
`dsoa.run.plugin`	string	resource stable Display name: `Dynatrace Snowflake Observability Agent execution plugin name` The name of the Dynatrace Snowflake Observability Agent plugin that produced this telemetry. Use to filter all telemetry from a specific plugin (for example, 'query_history', 'warehouse_usage'). Distinct from dsoa.run.context, which may represent a sub-context within a plugin. ⁷	`users`
`host.name`	string	resource experimental Display name: `Host name` The host name as determined on the data source (for instance, OneAgent, extensions or OpenTelemetry). Important: This is not the name of the host entity, which can be modified based on naming rules. ⁸ Tags: `permission`	`ip-10-178-54-32.ec2.internal`
`service.name`	string	resource stable Display name: `OTel service name` The logical name of the service. ⁹	`shoppingcart`
`telemetry.exporter.name`	string	resource experimental Display name: `Telemetry exporter name` The exporter name. ¹⁰	`odin`
`telemetry.exporter.version`	string	resource experimental Display name: `Telemetry exporter version` The full agent/exporter version. ¹¹	`1.285.1.20240101-256988`

Always 'snowflake' for all Dynatrace Snowflake Observability Agent telemetry.

User-configured deployment environment label, for example, 'PROD', 'STG', or 'DEV'. Set via 'core.snowflake.deployment_environment'.

⁴

Optional user-defined tag for grouping Snowflake accounts in multitenancy mode, set via 'core.tag'.

⁵

Identifies the specific sub-context within the plugin (for example, 'query_history', 'users_all_roles').

⁶

Unique identifier for a single Dynatrace Snowflake Observability Agent execution run. Changes on every invocation.

⁷

The Dynatrace Snowflake Observability Agent plugin that produced this telemetry (for example, 'query_history', 'warehouse_usage').

⁸

The Snowflake account hostname (for example, 'xy12345.snowflakecomputing.com'), from 'core.snowflake.host_name'.

⁹

Always the Snowflake account identifier without '.snowflakecomputing.com' suffix (for example, 'myorg-myaccount').

¹⁰

Always 'dynatrace.snowagent' — identifies Dynatrace Snowflake Observability Agent as the telemetry exporter.

¹¹

The installed Dynatrace Snowflake Observability Agent version in <major>.<minor>.<patch>.<build> format.

db.system has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`adabas`	Adabas (Adaptable Database System)	Adabas
`amazon-documentdb`	Amazon DocumentDB	DocumentDB
`aurora-mysql`	Amazon Aurora MySQL	Aurora MySQL
`aurora-postgresql`	Amazon Aurora PostgreSQL	Aurora PostgreSQL
`cache`	InterSystems Caché	InterSystems Caché
`cassandra`	Apache Cassandra	Cassandra
`clickhouse`	ClickHouse	ClickHouse
`cloudscape`	Cloudscape	Cloudscape
`cockroachdb`	CockroachDB	CockroachDB
`coldfusion`	ColdFusion IMQ	ColdFusion IMQ
`cosmosdb`	Microsoft Azure Cosmos DB	Cosmos DB
`couchbase`	Couchbase	Couchbase
`couchdb`	CouchDB	CouchDB
`databricks`	Databricks Data Platform	Databricks Data Platform
`db2`	IBM Db2	IBM Db2
`derby`	Apache Derby	Derby
`dl/i`	IBM DL/I	IBM DL/I
`dynamodb`	Amazon DynamoDB	DynamoDB
`edb`	EnterpriseDB	EnterpriseDB
`elasticsearch`	Elasticsearch	Elasticsearch
`filemaker`	FileMaker	FileMaker
`firebird`	Firebird	Firebird
`firstsql`	FirstSQL	FirstSQL
`geode`	Apache Geode	Geode
`h2`	H2	H2
`hanadb`	SAP HANA	SAP HANA
`hbase`	Apache HBase	HBase
`hive`	Apache Hive	Hive
`hsqldb`	HyperSQL DataBase	HSQLDB
`informix`	Informix	Informix
`ingres`	Ingres	Ingres
`instantdb`	InstantDB	InstantDB
`interbase`	InterBase	InterBase
`keyspaces-cassandra`	Amazon Keyspaces for Apache Cassandra	Keyspaces
`mariadb`	MariaDB	MariaDB
`maxdb`	SAP MaxDB	SAP MaxDB
`memcached`	Memcached	Memcached
`mongodb`	MongoDB	MongoDB
`mssql`	Microsoft SQL Server	SQL Server
`mssqlcompact`	Microsoft SQL Server Compact	SQL Server Compact
`mysql`	MySQL	MySQL
`neo4j`	Neo4j	Neo4j
`neptune`	Amazon Neptune	Neptune
`netezza`	Netezza	Netezza
`opensearch`	OpenSearch	OpenSearch
`oracle`	Oracle Database	Oracle
`other_sql`	Some other SQL database. Fallback only. See notes.	Other SQL
`pervasive`	Pervasive PSQL	Pervasive PSQL
`phoenix`	Apache Phoenix	Apache Phoenix
`pointbase`	PointBase	PointBase
`postgresql`	PostgreSQL	PostgreSQL
`progress`	Progress Database	Progress
`redis`	Redis	Redis
`redshift`	Amazon Redshift	Redshift
`snowflake`	Snowflake Data Platform	Snowflake Data Platform
`spanner`	Cloud Spanner	Cloud Spanner
`sqlite`	SQLite	SQLite
`sybase`	Sybase	Sybase
`teradata`	Teradata	Teradata
`valkey`	Valkey	Valkey
`vertica`	Vertica	Vertica

Attribute fields for login history log records.

Attribute	Type	Description	Examples
`authentication.factor.first`	string	stable Display name: `First authentication factor` The first factor used for authentication, typically a password.	`PASSWORD`
`authentication.factor.second`	string	stable Display name: `Second authentication factor` The second factor used for authentication, such as an MFA token. Omitted when only a single factor was used.	`TOTP`
`client.application.id`	string	stable Display name: `Client application ID` The ID of the client application used for the session.	`SnowflakeJDBCDriver`
`client.application.version`	string	experimental Display name: `Client application version` The version of the client application used for the session.	`1.0.0`
`client.build_id`	string	experimental Display name: `Client build ID` The build ID of the client application.	`build123`
`client.environment`	string	stable Display name: `Client environment` The environment of the client application.	`PRODUCTION`
`client.version`	string	experimental Display name: `Client version` The version of the client software used to connect to Snowflake.	`1.0.0`
`db.snowflake.connection`	string	experimental Display name: `Snowflake connection name` The name of the connection used by the client, or NULL if the client is not using a connection URL.	`connection_1`
`event.related_id`	long	experimental Display name: `Related event ID` An identifier for a related event, if applicable.	`987654321`
`snowflake.session.closed_reason`	string	experimental Display name: `Snowflake session closed reason` The reason the session was closed.	`USER_LOGOUT`
`snowflake.session.start`	long	experimental Display name: `Snowflake session start time` The start time of the session.	`1633046400000000000`
`snowflake.status.code`	string	experimental Display name: `Snowflake status code` The status of the login attempt, indicating success (OK) or failure (ERROR).	`OK`
`snowflake.status.message`	string	experimental Display name: `Snowflake status message` A human-readable message providing additional detail about the operation status.	`Login successful`

Snowflake metering log records

Log records emitted by the Dynatrace Snowflake Observability Agent metering plugin.

Query

Fetch the 100 most recent Dynatrace Snowflake Observability Agent metering plugin log entries from Grail.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "metering"
| sort timestamp desc
| limit 100

Inspect per-service credit consumption readings from the metering plugin.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "metering"
| filter isNotNull(snowflake.service.name)
| fields timestamp, snowflake.service.name, snowflake.service.type, snowflake.credits.used
| sort timestamp desc
| limit 50

Rank Snowflake services by total metered credit consumption.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "metering"
| filter isNotNull(snowflake.service.name)
| summarize { total_credits = sum(toDouble(snowflake.credits.used)) }, by: { snowflake.service.name }
| sort total_credits desc
| limit 25

Dynatrace Snowflake Observability Agent resource fields

Fields present on all Dynatrace Snowflake Observability Agent telemetry records. Synced with config.py RESOURCE_ATTRIBUTES.

Attribute	Type	Description	Examples
`db.system`	string	experimental Display name: `Database system` An identifier for the database management system (DBMS) product being used. See below for a list of well-known identifiers. ¹	`mongodb`; `mysql`
`deployment.environment`	string	resource deprecated Use deployment.environment.name instead. Display name: `Snowflake deployment environment` Deprecated alias for deployment.environment.name. The deployment environment, for example, production, staging, or development. Will be removed in release 1.3.0. ²	`PROD`
`deployment.environment.name`	string	resource stable Display name: `Snowflake deployment environment name` The deployment environment name (OTel semconv canonical field), for example, production, staging, or development. Emitted alongside deployment.environment during the deprecation window. ³	`PROD`
`deployment.environment.tag`	string	resource stable Display name: `Deployment environment tag` Optional tag for the deployment environment in multitenancy mode ⁴	`SA080`
`dsoa.run.context`	string	resource stable Display name: `Dynatrace Snowflake Observability Agent execution context` The name of the Dynatrace Snowflake Observability Agent context (part of plugin) used to produce the telemetry (logs, traces, metrics, or events). In case of multiple contexts within the same plugin, this helps differentiate between them. If plugin delivers only one context, this field will have the same value as the plugin name. ⁵	`users_all_roles`
`dsoa.run.id`	string	resource stable Display name: `Dynatrace Snowflake Observability Agent execution unique identifier` Unique ID of each execution of the Dynatrace Snowflake Observability Agent plugin. It can be used to differentiate between telemetry produced between two executions, for example, to calculate the change in the system. ⁶	`4aa7c76c-e98c-4b8b-a5b3-a8a721bbde2d`
`dsoa.run.plugin`	string	resource stable Display name: `Dynatrace Snowflake Observability Agent execution plugin name` The name of the Dynatrace Snowflake Observability Agent plugin that produced this telemetry. Use to filter all telemetry from a specific plugin (for example, 'query_history', 'warehouse_usage'). Distinct from dsoa.run.context, which may represent a sub-context within a plugin. ⁷	`users`
`host.name`	string	resource experimental Display name: `Host name` The host name as determined on the data source (for instance, OneAgent, extensions or OpenTelemetry). Important: This is not the name of the host entity, which can be modified based on naming rules. ⁸ Tags: `permission`	`ip-10-178-54-32.ec2.internal`
`service.name`	string	resource stable Display name: `OTel service name` The logical name of the service. ⁹	`shoppingcart`
`telemetry.exporter.name`	string	resource experimental Display name: `Telemetry exporter name` The exporter name. ¹⁰	`odin`
`telemetry.exporter.version`	string	resource experimental Display name: `Telemetry exporter version` The full agent/exporter version. ¹¹	`1.285.1.20240101-256988`

Always 'snowflake' for all Dynatrace Snowflake Observability Agent telemetry.

User-configured deployment environment label, for example, 'PROD', 'STG', or 'DEV'. Set via 'core.snowflake.deployment_environment'.

⁴

Optional user-defined tag for grouping Snowflake accounts in multitenancy mode, set via 'core.tag'.

⁵

Identifies the specific sub-context within the plugin (for example, 'query_history', 'users_all_roles').

⁶

Unique identifier for a single Dynatrace Snowflake Observability Agent execution run. Changes on every invocation.

⁷

The Dynatrace Snowflake Observability Agent plugin that produced this telemetry (for example, 'query_history', 'warehouse_usage').

⁸

The Snowflake account hostname (for example, 'xy12345.snowflakecomputing.com'), from 'core.snowflake.host_name'.

⁹

Always the Snowflake account identifier without '.snowflakecomputing.com' suffix (for example, 'myorg-myaccount').

¹⁰

Always 'dynatrace.snowagent' — identifies Dynatrace Snowflake Observability Agent as the telemetry exporter.

¹¹

The installed Dynatrace Snowflake Observability Agent version in <major>.<minor>.<patch>.<build> format.

db.system has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`adabas`	Adabas (Adaptable Database System)	Adabas
`amazon-documentdb`	Amazon DocumentDB	DocumentDB
`aurora-mysql`	Amazon Aurora MySQL	Aurora MySQL
`aurora-postgresql`	Amazon Aurora PostgreSQL	Aurora PostgreSQL
`cache`	InterSystems Caché	InterSystems Caché
`cassandra`	Apache Cassandra	Cassandra
`clickhouse`	ClickHouse	ClickHouse
`cloudscape`	Cloudscape	Cloudscape
`cockroachdb`	CockroachDB	CockroachDB
`coldfusion`	ColdFusion IMQ	ColdFusion IMQ
`cosmosdb`	Microsoft Azure Cosmos DB	Cosmos DB
`couchbase`	Couchbase	Couchbase
`couchdb`	CouchDB	CouchDB
`databricks`	Databricks Data Platform	Databricks Data Platform
`db2`	IBM Db2	IBM Db2
`derby`	Apache Derby	Derby
`dl/i`	IBM DL/I	IBM DL/I
`dynamodb`	Amazon DynamoDB	DynamoDB
`edb`	EnterpriseDB	EnterpriseDB
`elasticsearch`	Elasticsearch	Elasticsearch
`filemaker`	FileMaker	FileMaker
`firebird`	Firebird	Firebird
`firstsql`	FirstSQL	FirstSQL
`geode`	Apache Geode	Geode
`h2`	H2	H2
`hanadb`	SAP HANA	SAP HANA
`hbase`	Apache HBase	HBase
`hive`	Apache Hive	Hive
`hsqldb`	HyperSQL DataBase	HSQLDB
`informix`	Informix	Informix
`ingres`	Ingres	Ingres
`instantdb`	InstantDB	InstantDB
`interbase`	InterBase	InterBase
`keyspaces-cassandra`	Amazon Keyspaces for Apache Cassandra	Keyspaces
`mariadb`	MariaDB	MariaDB
`maxdb`	SAP MaxDB	SAP MaxDB
`memcached`	Memcached	Memcached
`mongodb`	MongoDB	MongoDB
`mssql`	Microsoft SQL Server	SQL Server
`mssqlcompact`	Microsoft SQL Server Compact	SQL Server Compact
`mysql`	MySQL	MySQL
`neo4j`	Neo4j	Neo4j
`neptune`	Amazon Neptune	Neptune
`netezza`	Netezza	Netezza
`opensearch`	OpenSearch	OpenSearch
`oracle`	Oracle Database	Oracle
`other_sql`	Some other SQL database. Fallback only. See notes.	Other SQL
`pervasive`	Pervasive PSQL	Pervasive PSQL
`phoenix`	Apache Phoenix	Apache Phoenix
`pointbase`	PointBase	PointBase
`postgresql`	PostgreSQL	PostgreSQL
`progress`	Progress Database	Progress
`redis`	Redis	Redis
`redshift`	Amazon Redshift	Redshift
`snowflake`	Snowflake Data Platform	Snowflake Data Platform
`spanner`	Cloud Spanner	Cloud Spanner
`sqlite`	SQLite	SQLite
`sybase`	Sybase	Sybase
`teradata`	Teradata	Teradata
`valkey`	Valkey	Valkey
`vertica`	Vertica	Vertica

Metering log record fields

Attribute fields for metering log records.

Attribute	Type	Description	Examples
`snowflake.service.entity_id`	long	experimental Display name: `Snowflake service entity ID` Unique Snowflake identifier of the service entity.	`12345`

Snowflake organization costs log records

Log records emitted by the Dynatrace Snowflake Observability Agent org_costs plugin.

Query

Fetch the 100 most recent Dynatrace Snowflake Observability Agent org_costs plugin log entries from Grail.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "org_costs"
| sort timestamp desc
| limit 100

Inspect per-account organization credit and billing readings from the org_costs plugin.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "org_costs"
| filter isNotNull(snowflake.account.name)
| fields timestamp, snowflake.account.name, snowflake.org.credits.used, snowflake.org.billing.amount
| sort timestamp desc
| limit 50

Rank Snowflake accounts by total organization billing amount.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "org_costs"
| filter isNotNull(snowflake.account.name)
| summarize { total_billed = sum(toDouble(snowflake.org.billing.amount)) }, by: { snowflake.account.name }
| sort total_billed desc
| limit 25

Dynatrace Snowflake Observability Agent resource fields

Fields present on all Dynatrace Snowflake Observability Agent telemetry records. Synced with config.py RESOURCE_ATTRIBUTES.

Attribute	Type	Description	Examples
`db.system`	string	experimental Display name: `Database system` An identifier for the database management system (DBMS) product being used. See below for a list of well-known identifiers. ¹	`mongodb`; `mysql`
`deployment.environment`	string	resource deprecated Use deployment.environment.name instead. Display name: `Snowflake deployment environment` Deprecated alias for deployment.environment.name. The deployment environment, for example, production, staging, or development. Will be removed in release 1.3.0. ²	`PROD`
`deployment.environment.name`	string	resource stable Display name: `Snowflake deployment environment name` The deployment environment name (OTel semconv canonical field), for example, production, staging, or development. Emitted alongside deployment.environment during the deprecation window. ³	`PROD`
`deployment.environment.tag`	string	resource stable Display name: `Deployment environment tag` Optional tag for the deployment environment in multitenancy mode ⁴	`SA080`
`dsoa.run.context`	string	resource stable Display name: `Dynatrace Snowflake Observability Agent execution context` The name of the Dynatrace Snowflake Observability Agent context (part of plugin) used to produce the telemetry (logs, traces, metrics, or events). In case of multiple contexts within the same plugin, this helps differentiate between them. If plugin delivers only one context, this field will have the same value as the plugin name. ⁵	`users_all_roles`
`dsoa.run.id`	string	resource stable Display name: `Dynatrace Snowflake Observability Agent execution unique identifier` Unique ID of each execution of the Dynatrace Snowflake Observability Agent plugin. It can be used to differentiate between telemetry produced between two executions, for example, to calculate the change in the system. ⁶	`4aa7c76c-e98c-4b8b-a5b3-a8a721bbde2d`
`dsoa.run.plugin`	string	resource stable Display name: `Dynatrace Snowflake Observability Agent execution plugin name` The name of the Dynatrace Snowflake Observability Agent plugin that produced this telemetry. Use to filter all telemetry from a specific plugin (for example, 'query_history', 'warehouse_usage'). Distinct from dsoa.run.context, which may represent a sub-context within a plugin. ⁷	`users`
`host.name`	string	resource experimental Display name: `Host name` The host name as determined on the data source (for instance, OneAgent, extensions or OpenTelemetry). Important: This is not the name of the host entity, which can be modified based on naming rules. ⁸ Tags: `permission`	`ip-10-178-54-32.ec2.internal`
`service.name`	string	resource stable Display name: `OTel service name` The logical name of the service. ⁹	`shoppingcart`
`telemetry.exporter.name`	string	resource experimental Display name: `Telemetry exporter name` The exporter name. ¹⁰	`odin`
`telemetry.exporter.version`	string	resource experimental Display name: `Telemetry exporter version` The full agent/exporter version. ¹¹	`1.285.1.20240101-256988`

Always 'snowflake' for all Dynatrace Snowflake Observability Agent telemetry.

User-configured deployment environment label, for example, 'PROD', 'STG', or 'DEV'. Set via 'core.snowflake.deployment_environment'.

⁴

Optional user-defined tag for grouping Snowflake accounts in multitenancy mode, set via 'core.tag'.

⁵

Identifies the specific sub-context within the plugin (for example, 'query_history', 'users_all_roles').

⁶

Unique identifier for a single Dynatrace Snowflake Observability Agent execution run. Changes on every invocation.

⁷

The Dynatrace Snowflake Observability Agent plugin that produced this telemetry (for example, 'query_history', 'warehouse_usage').

⁸

The Snowflake account hostname (for example, 'xy12345.snowflakecomputing.com'), from 'core.snowflake.host_name'.

⁹

Always the Snowflake account identifier without '.snowflakecomputing.com' suffix (for example, 'myorg-myaccount').

¹⁰

Always 'dynatrace.snowagent' — identifies Dynatrace Snowflake Observability Agent as the telemetry exporter.

¹¹

The installed Dynatrace Snowflake Observability Agent version in <major>.<minor>.<patch>.<build> format.

db.system has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`adabas`	Adabas (Adaptable Database System)	Adabas
`amazon-documentdb`	Amazon DocumentDB	DocumentDB
`aurora-mysql`	Amazon Aurora MySQL	Aurora MySQL
`aurora-postgresql`	Amazon Aurora PostgreSQL	Aurora PostgreSQL
`cache`	InterSystems Caché	InterSystems Caché
`cassandra`	Apache Cassandra	Cassandra
`clickhouse`	ClickHouse	ClickHouse
`cloudscape`	Cloudscape	Cloudscape
`cockroachdb`	CockroachDB	CockroachDB
`coldfusion`	ColdFusion IMQ	ColdFusion IMQ
`cosmosdb`	Microsoft Azure Cosmos DB	Cosmos DB
`couchbase`	Couchbase	Couchbase
`couchdb`	CouchDB	CouchDB
`databricks`	Databricks Data Platform	Databricks Data Platform
`db2`	IBM Db2	IBM Db2
`derby`	Apache Derby	Derby
`dl/i`	IBM DL/I	IBM DL/I
`dynamodb`	Amazon DynamoDB	DynamoDB
`edb`	EnterpriseDB	EnterpriseDB
`elasticsearch`	Elasticsearch	Elasticsearch
`filemaker`	FileMaker	FileMaker
`firebird`	Firebird	Firebird
`firstsql`	FirstSQL	FirstSQL
`geode`	Apache Geode	Geode
`h2`	H2	H2
`hanadb`	SAP HANA	SAP HANA
`hbase`	Apache HBase	HBase
`hive`	Apache Hive	Hive
`hsqldb`	HyperSQL DataBase	HSQLDB
`informix`	Informix	Informix
`ingres`	Ingres	Ingres
`instantdb`	InstantDB	InstantDB
`interbase`	InterBase	InterBase
`keyspaces-cassandra`	Amazon Keyspaces for Apache Cassandra	Keyspaces
`mariadb`	MariaDB	MariaDB
`maxdb`	SAP MaxDB	SAP MaxDB
`memcached`	Memcached	Memcached
`mongodb`	MongoDB	MongoDB
`mssql`	Microsoft SQL Server	SQL Server
`mssqlcompact`	Microsoft SQL Server Compact	SQL Server Compact
`mysql`	MySQL	MySQL
`neo4j`	Neo4j	Neo4j
`neptune`	Amazon Neptune	Neptune
`netezza`	Netezza	Netezza
`opensearch`	OpenSearch	OpenSearch
`oracle`	Oracle Database	Oracle
`other_sql`	Some other SQL database. Fallback only. See notes.	Other SQL
`pervasive`	Pervasive PSQL	Pervasive PSQL
`phoenix`	Apache Phoenix	Apache Phoenix
`pointbase`	PointBase	PointBase
`postgresql`	PostgreSQL	PostgreSQL
`progress`	Progress Database	Progress
`redis`	Redis	Redis
`redshift`	Amazon Redshift	Redshift
`snowflake`	Snowflake Data Platform	Snowflake Data Platform
`spanner`	Cloud Spanner	Cloud Spanner
`sqlite`	SQLite	SQLite
`sybase`	Sybase	Sybase
`teradata`	Teradata	Teradata
`valkey`	Valkey	Valkey
`vertica`	Vertica	Vertica

Organization costs log record fields

Attribute fields for organization costs log records.

Attribute	Type	Description	Examples
`snowflake.org.billing.contract_number`	string	experimental Display name: `Snowflake billing contract number` The contract number associated with the Snowflake billing balance.	`CONTRACT-001`

Snowflake query history log records

Log records emitted by the Dynatrace Snowflake Observability Agent query_history plugin.

Query

Fetch the 100 most recent Dynatrace Snowflake Observability Agent query_history plugin log entries from Grail.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "query_history"
| sort timestamp desc
| limit 100

Find Snowflake queries that ran longer than five minutes, with their user and warehouse.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "query_history"
| filter isNotNull(snowflake.query.id)
| fieldsAdd running_min = toLong(snowflake.time.total_elapsed) / 1000 / 60
| filter running_min > 5
| fields timestamp, snowflake.query.id, db.user, snowflake.warehouse.name, running_min
| sort running_min desc
| limit 50

Rank warehouses by the p90 execution time of their Snowflake queries.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "query_history"
| filter isNotNull(snowflake.warehouse.name)
| summarize {
    queries = count(),
    avg_exec_ms = avg(toLong(snowflake.time.execution)),
    p90_exec_ms = percentile(toLong(snowflake.time.execution), 90)
  }, by: { snowflake.warehouse.name }
| sort p90_exec_ms desc
| limit 25

Dynatrace Snowflake Observability Agent resource fields

Fields present on all Dynatrace Snowflake Observability Agent telemetry records. Synced with config.py RESOURCE_ATTRIBUTES.

Attribute	Type	Description	Examples
`db.system`	string	experimental Display name: `Database system` An identifier for the database management system (DBMS) product being used. See below for a list of well-known identifiers. ¹	`mongodb`; `mysql`
`deployment.environment`	string	resource deprecated Use deployment.environment.name instead. Display name: `Snowflake deployment environment` Deprecated alias for deployment.environment.name. The deployment environment, for example, production, staging, or development. Will be removed in release 1.3.0. ²	`PROD`
`deployment.environment.name`	string	resource stable Display name: `Snowflake deployment environment name` The deployment environment name (OTel semconv canonical field), for example, production, staging, or development. Emitted alongside deployment.environment during the deprecation window. ³	`PROD`
`deployment.environment.tag`	string	resource stable Display name: `Deployment environment tag` Optional tag for the deployment environment in multitenancy mode ⁴	`SA080`
`dsoa.run.context`	string	resource stable Display name: `Dynatrace Snowflake Observability Agent execution context` The name of the Dynatrace Snowflake Observability Agent context (part of plugin) used to produce the telemetry (logs, traces, metrics, or events). In case of multiple contexts within the same plugin, this helps differentiate between them. If plugin delivers only one context, this field will have the same value as the plugin name. ⁵	`users_all_roles`
`dsoa.run.id`	string	resource stable Display name: `Dynatrace Snowflake Observability Agent execution unique identifier` Unique ID of each execution of the Dynatrace Snowflake Observability Agent plugin. It can be used to differentiate between telemetry produced between two executions, for example, to calculate the change in the system. ⁶	`4aa7c76c-e98c-4b8b-a5b3-a8a721bbde2d`
`dsoa.run.plugin`	string	resource stable Display name: `Dynatrace Snowflake Observability Agent execution plugin name` The name of the Dynatrace Snowflake Observability Agent plugin that produced this telemetry. Use to filter all telemetry from a specific plugin (for example, 'query_history', 'warehouse_usage'). Distinct from dsoa.run.context, which may represent a sub-context within a plugin. ⁷	`users`
`host.name`	string	resource experimental Display name: `Host name` The host name as determined on the data source (for instance, OneAgent, extensions or OpenTelemetry). Important: This is not the name of the host entity, which can be modified based on naming rules. ⁸ Tags: `permission`	`ip-10-178-54-32.ec2.internal`
`service.name`	string	resource stable Display name: `OTel service name` The logical name of the service. ⁹	`shoppingcart`
`telemetry.exporter.name`	string	resource experimental Display name: `Telemetry exporter name` The exporter name. ¹⁰	`odin`
`telemetry.exporter.version`	string	resource experimental Display name: `Telemetry exporter version` The full agent/exporter version. ¹¹	`1.285.1.20240101-256988`

Always 'snowflake' for all Dynatrace Snowflake Observability Agent telemetry.

User-configured deployment environment label, for example, 'PROD', 'STG', or 'DEV'. Set via 'core.snowflake.deployment_environment'.

⁴

Optional user-defined tag for grouping Snowflake accounts in multitenancy mode, set via 'core.tag'.

⁵

Identifies the specific sub-context within the plugin (for example, 'query_history', 'users_all_roles').

⁶

Unique identifier for a single Dynatrace Snowflake Observability Agent execution run. Changes on every invocation.

⁷

The Dynatrace Snowflake Observability Agent plugin that produced this telemetry (for example, 'query_history', 'warehouse_usage').

⁸

The Snowflake account hostname (for example, 'xy12345.snowflakecomputing.com'), from 'core.snowflake.host_name'.

⁹

Always the Snowflake account identifier without '.snowflakecomputing.com' suffix (for example, 'myorg-myaccount').

¹⁰

Always 'dynatrace.snowagent' — identifies Dynatrace Snowflake Observability Agent as the telemetry exporter.

¹¹

The installed Dynatrace Snowflake Observability Agent version in <major>.<minor>.<patch>.<build> format.

db.system has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`adabas`	Adabas (Adaptable Database System)	Adabas
`amazon-documentdb`	Amazon DocumentDB	DocumentDB
`aurora-mysql`	Amazon Aurora MySQL	Aurora MySQL
`aurora-postgresql`	Amazon Aurora PostgreSQL	Aurora PostgreSQL
`cache`	InterSystems Caché	InterSystems Caché
`cassandra`	Apache Cassandra	Cassandra
`clickhouse`	ClickHouse	ClickHouse
`cloudscape`	Cloudscape	Cloudscape
`cockroachdb`	CockroachDB	CockroachDB
`coldfusion`	ColdFusion IMQ	ColdFusion IMQ
`cosmosdb`	Microsoft Azure Cosmos DB	Cosmos DB
`couchbase`	Couchbase	Couchbase
`couchdb`	CouchDB	CouchDB
`databricks`	Databricks Data Platform	Databricks Data Platform
`db2`	IBM Db2	IBM Db2
`derby`	Apache Derby	Derby
`dl/i`	IBM DL/I	IBM DL/I
`dynamodb`	Amazon DynamoDB	DynamoDB
`edb`	EnterpriseDB	EnterpriseDB
`elasticsearch`	Elasticsearch	Elasticsearch
`filemaker`	FileMaker	FileMaker
`firebird`	Firebird	Firebird
`firstsql`	FirstSQL	FirstSQL
`geode`	Apache Geode	Geode
`h2`	H2	H2
`hanadb`	SAP HANA	SAP HANA
`hbase`	Apache HBase	HBase
`hive`	Apache Hive	Hive
`hsqldb`	HyperSQL DataBase	HSQLDB
`informix`	Informix	Informix
`ingres`	Ingres	Ingres
`instantdb`	InstantDB	InstantDB
`interbase`	InterBase	InterBase
`keyspaces-cassandra`	Amazon Keyspaces for Apache Cassandra	Keyspaces
`mariadb`	MariaDB	MariaDB
`maxdb`	SAP MaxDB	SAP MaxDB
`memcached`	Memcached	Memcached
`mongodb`	MongoDB	MongoDB
`mssql`	Microsoft SQL Server	SQL Server
`mssqlcompact`	Microsoft SQL Server Compact	SQL Server Compact
`mysql`	MySQL	MySQL
`neo4j`	Neo4j	Neo4j
`neptune`	Amazon Neptune	Neptune
`netezza`	Netezza	Netezza
`opensearch`	OpenSearch	OpenSearch
`oracle`	Oracle Database	Oracle
`other_sql`	Some other SQL database. Fallback only. See notes.	Other SQL
`pervasive`	Pervasive PSQL	Pervasive PSQL
`phoenix`	Apache Phoenix	Apache Phoenix
`pointbase`	PointBase	PointBase
`postgresql`	PostgreSQL	PostgreSQL
`progress`	Progress Database	Progress
`redis`	Redis	Redis
`redshift`	Amazon Redshift	Redshift
`snowflake`	Snowflake Data Platform	Snowflake Data Platform
`spanner`	Cloud Spanner	Cloud Spanner
`sqlite`	SQLite	SQLite
`sybase`	Sybase	Sybase
`teradata`	Teradata	Teradata
`valkey`	Valkey	Valkey
`vertica`	Vertica	Vertica

Query history log record fields

Attribute fields for query history log records.

Attribute	Type	Description	Examples
`db.snowflake.tables`	string[]	stable Display name: `Snowflake tables used in query` The tables involved in the query.	`['users', 'orders']`
`db.snowflake.views`	string[]	stable Display name: `Snowflake views used in query` The views involved in the query. ¹	`['user_view']`
`dsoa.plugins.query_history.obfuscation_mode`	string	experimental Display name: `Dynatrace Snowflake Observability Agent query history obfuscation mode` Configuration key controlling query text obfuscation mode applied to `db.query.text` and `snowflake.error.message`. ²	`none`
`dsoa.plugins.query_history.track_ddl_changes`	boolean	experimental Display name: `Dynatrace Snowflake Observability Agent query history DDL change tracking indicator` EXPERIMENTAL. When `true`, the plugin surfaces DDL change attribution attributes (`snowflake.object.type`, `.id`, `.name`, `snowflake.object.ddl.operation`, `snowflake.object.ddl.properties`) on `query_history` events whose `ACCESS_HISTORY` row carries an `OBJECT_MODIFIED_BY_DDL` payload. Covers database-object DDL only (tables, views, schemas, procedures). Warehouse and resource-monitor DDL does not populate `OBJECT_MODIFIED_BY_DDL` and is not affected by this setting — use `db.operation.name` for warehouse change detection. Default `false` preserves backward-compatible behavior. May be refactored into a dedicated plugin in a future release. ³	`false`
`snowflake.cluster_number`	long	experimental Display name: `Snowflake warehouse cluster number` The warehouse cluster number associated with the query.	`1`
`snowflake.cost_attribution.period_end`	long	experimental Display name: `Snowflake cost attribution period end` End of the cost attribution summary window.	`1730844667000000000`
`snowflake.cost_attribution.period_start`	long	experimental Display name: `Snowflake cost attribution period start` Start of the cost attribution summary window.	`1730841067000000000`
`snowflake.database.id`	long	stable Display name: `Snowflake database ID` The unique identifier of the database involved in the query. ⁴	`123456`
`snowflake.object.ddl.operation`	string	stable Display name: `Snowflake DDL operation` The SQL keyword that specifies the operation on the table, view, or column.	`REPLACE`
`snowflake.object.type`	string	stable Display name: `Snowflake object type` The domain of the object defined or modified by the DDL operation.	`Table`
`snowflake.query.accel_est.estimated_query_times`	string	stable Display name: `Snowflake query acceleration estimated execution times` Object that contains the estimated query execution time in seconds for different query acceleration scale factors. If the status for the query is not eligible for query acceleration, this object is empty. ⁵	`{ "scaleFactor1": 10, "scaleFactor2": 5 }`
`snowflake.query.accel_est.status`	string	stable Display name: `Snowflake query acceleration status` Indicates whether the query is eligible to benefit from the query acceleration service.	`eligible`
`snowflake.query.accel_est.upper_limit_scale_factor`	long	stable Display name: `Snowflake query acceleration upper limit scale factor` Number of the highest query acceleration scale factor in the estimatedQueryTimes object. If the status for the query is not eligible for query acceleration, this field is set to 0.	`2`
`snowflake.query.data_transfer.inbound.cloud`	string	stable Display name: `Snowflake inbound data transfer cloud` The cloud provider from which data was transferred inbound.	`AWS`
`snowflake.query.data_transfer.inbound.region`	string	stable Display name: `Snowflake inbound data transfer region` The region from which data was transferred inbound.	`us-west-2`
`snowflake.query.data_transfer.outbound.cloud`	string	stable Display name: `Snowflake outbound data transfer cloud` The cloud provider to which data was transferred outbound.	`AWS`
`snowflake.query.data_transfer.outbound.region`	string	stable Display name: `Snowflake outbound data transfer region` The region to which data was transferred outbound.	`us-west-2`
`snowflake.query.is_client_generated`	boolean	stable Display name: `Snowflake client generated query indicator` Indicates if the statement was generated by the client.	`true`
`snowflake.query.retry_cause`	string	stable Display name: `Snowflake query retry cause` The cause for retrying the query, if applicable.	`Network issue`
`snowflake.query.transaction_id`	long	stable Display name: `Snowflake query transaction ID` The transaction ID associated with the query.	`7890123456`
`snowflake.query.with_operator_stats`	boolean	experimental Display name: `Snowflake query execution plan telemetry indicator` Indicates if the query was executed with operator-level statistics enabled.	`true`
`snowflake.release_version`	string	experimental Display name: `Snowflake release version` The release version of Snowflake at the time of query execution.	`5.0`
`snowflake.role.type`	string	stable Display name: `Snowflake role type` The type of role used to execute the query.	`PRIMARY`
`snowflake.schema.id`	long	experimental Display name: `Snowflake schema ID` The unique identifier of the schema involved in the query.	`78901`
`snowflake.secondary_role_stats`	string	experimental Display name: `Snowflake secondary role statistics` Statistics related to secondary roles used during the query execution.	`role_stat1`
`snowflake.warehouse.cluster.number`	long	stable Display name: `Snowflake warehouse cluster number` The cluster number of the warehouse used.	`1`
`snowflake.warehouse.id`	long	experimental Display name: `Snowflake warehouse ID` The unique identifier of the warehouse used.	`12345`
`snowflake.warehouse.size`	string	stable Display name: `Snowflake warehouse size` The size of the warehouse used.	`X-SMALL`
`snowflake.warehouse.type`	string	stable Display name: `Snowflake warehouse type` The type of warehouse used.	`STANDARD`

Fully proprietary; no OTel analog.

Note: this is the SD-catalog attribute name; the actual config path read at runtime is plugins.query_history.obfuscation_mode (no dsoa. prefix) — see 050_f_get_query_history.sql.

Note: this is the SD-catalog attribute name; the actual config path is plugins.query_history.track_ddl_changes (no dsoa. prefix). Not currently wired up to any reader in code — setting this has no runtime effect yet.

⁴

ACCOUNT_USAGE.DATABASES supplies related fields (name, owner, owner_role_type, type, is_transient, lifecycle, retention_time, comment) but these should be populated by a future inventory plugin, not query_history (≈180-min latency + cost). In query_history, snowflake.database.id stays a foreign key only.

⁵

Serialized JSON object stored as string in Grail. Contains estimated query execution times per scale factor. Parse with parseJson() in DQL.

Snowflake shares log records

Log records emitted by the Dynatrace Snowflake Observability Agent shares plugin.

Query

Fetch the 100 most recent Dynatrace Snowflake Observability Agent shares plugin log entries (inbound and outbound shares) from Grail.

fetch logs
| filter db.system == "snowflake"
| filter in(dsoa.run.context, {"inbound_shares", "outbound_shares"})
| sort timestamp desc
| limit 100

Inspect outbound Snowflake shares and the objects they expose.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.context == "outbound_shares"
| filter isNotNull(snowflake.share.name)
| fields timestamp, snowflake.share.name, snowflake.table.full_name
| sort timestamp desc
| limit 50

Rank Snowflake shares by the number of shared objects they contain.

fetch logs
| filter db.system == "snowflake"
| filter in(dsoa.run.context, {"inbound_shares", "outbound_shares"})
| filter isNotNull(snowflake.share.name)
| summarize { objects = count() }, by: { snowflake.share.name }
| sort objects desc
| limit 25

Dynatrace Snowflake Observability Agent resource fields

Fields present on all Dynatrace Snowflake Observability Agent telemetry records. Synced with config.py RESOURCE_ATTRIBUTES.

Attribute	Type	Description	Examples
`db.system`	string	experimental Display name: `Database system` An identifier for the database management system (DBMS) product being used. See below for a list of well-known identifiers. ¹	`mongodb`; `mysql`
`deployment.environment`	string	resource deprecated Use deployment.environment.name instead. Display name: `Snowflake deployment environment` Deprecated alias for deployment.environment.name. The deployment environment, for example, production, staging, or development. Will be removed in release 1.3.0. ²	`PROD`
`deployment.environment.name`	string	resource stable Display name: `Snowflake deployment environment name` The deployment environment name (OTel semconv canonical field), for example, production, staging, or development. Emitted alongside deployment.environment during the deprecation window. ³	`PROD`
`deployment.environment.tag`	string	resource stable Display name: `Deployment environment tag` Optional tag for the deployment environment in multitenancy mode ⁴	`SA080`
`dsoa.run.context`	string	resource stable Display name: `Dynatrace Snowflake Observability Agent execution context` The name of the Dynatrace Snowflake Observability Agent context (part of plugin) used to produce the telemetry (logs, traces, metrics, or events). In case of multiple contexts within the same plugin, this helps differentiate between them. If plugin delivers only one context, this field will have the same value as the plugin name. ⁵	`users_all_roles`
`dsoa.run.id`	string	resource stable Display name: `Dynatrace Snowflake Observability Agent execution unique identifier` Unique ID of each execution of the Dynatrace Snowflake Observability Agent plugin. It can be used to differentiate between telemetry produced between two executions, for example, to calculate the change in the system. ⁶	`4aa7c76c-e98c-4b8b-a5b3-a8a721bbde2d`
`dsoa.run.plugin`	string	resource stable Display name: `Dynatrace Snowflake Observability Agent execution plugin name` The name of the Dynatrace Snowflake Observability Agent plugin that produced this telemetry. Use to filter all telemetry from a specific plugin (for example, 'query_history', 'warehouse_usage'). Distinct from dsoa.run.context, which may represent a sub-context within a plugin. ⁷	`users`
`host.name`	string	resource experimental Display name: `Host name` The host name as determined on the data source (for instance, OneAgent, extensions or OpenTelemetry). Important: This is not the name of the host entity, which can be modified based on naming rules. ⁸ Tags: `permission`	`ip-10-178-54-32.ec2.internal`
`service.name`	string	resource stable Display name: `OTel service name` The logical name of the service. ⁹	`shoppingcart`
`telemetry.exporter.name`	string	resource experimental Display name: `Telemetry exporter name` The exporter name. ¹⁰	`odin`
`telemetry.exporter.version`	string	resource experimental Display name: `Telemetry exporter version` The full agent/exporter version. ¹¹	`1.285.1.20240101-256988`

Always 'snowflake' for all Dynatrace Snowflake Observability Agent telemetry.

User-configured deployment environment label, for example, 'PROD', 'STG', or 'DEV'. Set via 'core.snowflake.deployment_environment'.

⁴

Optional user-defined tag for grouping Snowflake accounts in multitenancy mode, set via 'core.tag'.

⁵

Identifies the specific sub-context within the plugin (for example, 'query_history', 'users_all_roles').

⁶

Unique identifier for a single Dynatrace Snowflake Observability Agent execution run. Changes on every invocation.

⁷

The Dynatrace Snowflake Observability Agent plugin that produced this telemetry (for example, 'query_history', 'warehouse_usage').

⁸

The Snowflake account hostname (for example, 'xy12345.snowflakecomputing.com'), from 'core.snowflake.host_name'.

⁹

Always the Snowflake account identifier without '.snowflakecomputing.com' suffix (for example, 'myorg-myaccount').

¹⁰

Always 'dynatrace.snowagent' — identifies Dynatrace Snowflake Observability Agent as the telemetry exporter.

¹¹

The installed Dynatrace Snowflake Observability Agent version in <major>.<minor>.<patch>.<build> format.

db.system has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`adabas`	Adabas (Adaptable Database System)	Adabas
`amazon-documentdb`	Amazon DocumentDB	DocumentDB
`aurora-mysql`	Amazon Aurora MySQL	Aurora MySQL
`aurora-postgresql`	Amazon Aurora PostgreSQL	Aurora PostgreSQL
`cache`	InterSystems Caché	InterSystems Caché
`cassandra`	Apache Cassandra	Cassandra
`clickhouse`	ClickHouse	ClickHouse
`cloudscape`	Cloudscape	Cloudscape
`cockroachdb`	CockroachDB	CockroachDB
`coldfusion`	ColdFusion IMQ	ColdFusion IMQ
`cosmosdb`	Microsoft Azure Cosmos DB	Cosmos DB
`couchbase`	Couchbase	Couchbase
`couchdb`	CouchDB	CouchDB
`databricks`	Databricks Data Platform	Databricks Data Platform
`db2`	IBM Db2	IBM Db2
`derby`	Apache Derby	Derby
`dl/i`	IBM DL/I	IBM DL/I
`dynamodb`	Amazon DynamoDB	DynamoDB
`edb`	EnterpriseDB	EnterpriseDB
`elasticsearch`	Elasticsearch	Elasticsearch
`filemaker`	FileMaker	FileMaker
`firebird`	Firebird	Firebird
`firstsql`	FirstSQL	FirstSQL
`geode`	Apache Geode	Geode
`h2`	H2	H2
`hanadb`	SAP HANA	SAP HANA
`hbase`	Apache HBase	HBase
`hive`	Apache Hive	Hive
`hsqldb`	HyperSQL DataBase	HSQLDB
`informix`	Informix	Informix
`ingres`	Ingres	Ingres
`instantdb`	InstantDB	InstantDB
`interbase`	InterBase	InterBase
`keyspaces-cassandra`	Amazon Keyspaces for Apache Cassandra	Keyspaces
`mariadb`	MariaDB	MariaDB
`maxdb`	SAP MaxDB	SAP MaxDB
`memcached`	Memcached	Memcached
`mongodb`	MongoDB	MongoDB
`mssql`	Microsoft SQL Server	SQL Server
`mssqlcompact`	Microsoft SQL Server Compact	SQL Server Compact
`mysql`	MySQL	MySQL
`neo4j`	Neo4j	Neo4j
`neptune`	Amazon Neptune	Neptune
`netezza`	Netezza	Netezza
`opensearch`	OpenSearch	OpenSearch
`oracle`	Oracle Database	Oracle
`other_sql`	Some other SQL database. Fallback only. See notes.	Other SQL
`pervasive`	Pervasive PSQL	Pervasive PSQL
`phoenix`	Apache Phoenix	Apache Phoenix
`pointbase`	PointBase	PointBase
`postgresql`	PostgreSQL	PostgreSQL
`progress`	Progress Database	Progress
`redis`	Redis	Redis
`redshift`	Amazon Redshift	Redshift
`snowflake`	Snowflake Data Platform	Snowflake Data Platform
`spanner`	Cloud Spanner	Cloud Spanner
`sqlite`	SQLite	SQLite
`sybase`	Sybase	Sybase
`teradata`	Teradata	Teradata
`valkey`	Valkey	Valkey
`vertica`	Vertica	Vertica

Shares log record fields

Attribute fields for shares log records.

Attribute	Type	Description	Examples
`snowflake.grant.by`	string	stable Display name: `Snowflake account making the grant` Shows the name of the account which made the grant.	`ACCOUNTADMIN`
`snowflake.grant.grantee`	string	stable Display name: `Snowflake account receiving the grant` Shows the grantee account name.	`PARTNER_ACCOUNT`
`snowflake.grant.on`	string	stable Display name: `Snowflake grant object type` Shows on what type of object the grant was made.	`DATABASE`
`snowflake.grant.option`	boolean	experimental Display name: `Snowflake grant option availability` Indicates if grant option is available.	`false`
`snowflake.grant.privilege`	string	stable Display name: `Snowflake privilege granted` Shows the type of privilege granted.	`USAGE`
`snowflake.grant.to`	string	experimental Display name: `Snowflake share grant recipient` Shows to what the grant was made.	`SHARE`
`snowflake.share.has_details_reported`	boolean	experimental Display name: `Snowflake share details reported indicator` Indicates whether or not details on this share should be reported.	`false`
`snowflake.share.is_secure_objects_only`	boolean	stable Display name: `Snowflake share secure objects only indicator` Indicates if the share is only for secure objects.	`true`
`snowflake.share.kind`	string	stable Display name: `Snowflake share type` Indicates the type of share.	`OUTBOUND`
`snowflake.share.listing_global_name`	string	experimental Display name: `Snowflake share global name` Global name of the share listing.	`GLOBAL_SHARE_NAME`
`snowflake.share.owner`	string	stable Display name: `Snowflake share owner role` Shows the account owning the share.	`ACCOUNTADMIN`
`snowflake.share.shared_from`	string	experimental Display name: `Snowflake share owner account` Shows the owner account of the share.	`SNOWFLAKE`
`snowflake.share.shared_to`	string	experimental Display name: `Snowflake share recipient account` Shows the account the share was made to.	`PARTNER_ACCOUNT`
`snowflake.share.status`	string	stable Display name: `Snowflake share availability status` Indicates the availability status of the share. Set to UNAVAILABLE when the shared database is no longer accessible.	`UNAVAILABLE`
`snowflake.table.clustering_key`	string	experimental Display name: `Snowflake table clustering key` Clustering key for the table.	`DATE`
`snowflake.table.comment`	string	experimental Display name: `Snowflake table comment` Comment for this table.	`The tables defined in this database that are accessible to the current user's role.`
`snowflake.table.is_auto_clustering_on`	boolean	experimental Display name: `Snowflake automatic table clustering indicator` Indicates whether automatic clustering is enabled for the table.	`true`
`snowflake.table.is_dynamic`	boolean	experimental Display name: `Snowflake dynamic table indicator` Indicates whether the table is a dynamic table.	`false`
`snowflake.table.is_hybrid`	boolean	experimental Display name: `Snowflake hybrid table indicator` Indicates whether this is a hybrid table.	`false`
`snowflake.table.is_iceberg`	boolean	experimental Display name: `Snowflake Iceberg table indicator` Indicates whether the table is an Iceberg table.	`false`
`snowflake.table.is_temporary`	boolean	experimental Display name: `Snowflake temporary table indicator` Indicates whether this is a temporary table.	`false`
`snowflake.table.is_transient`	boolean	experimental Display name: `Snowflake transient table indicator` Indicates whether this is a transient table.	`false`
`snowflake.table.last_ddl_by`	string	experimental Display name: `Snowflake table last DDL executor` The current username for the user who executed the last DDL operation.	`DBA_USER`
`snowflake.table.owner`	string	experimental Display name: `Snowflake table owner role` Name of the role that owns the table.	`ACCOUNTADMIN`
`snowflake.table.retention_time`	long	experimental Display name: `Snowflake table time travel retention days` Number of days that historical data is retained for Time Travel.	`5`

Snowflake tasks log records

Log records emitted by the Dynatrace Snowflake Observability Agent tasks plugin.

Query

Fetch the 100 most recent Dynatrace Snowflake Observability Agent tasks plugin log entries from Grail.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "tasks"
| sort timestamp desc
| limit 100

Fetch log entries for failed Snowflake task runs.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "tasks"
| filter snowflake.task.run.state == "FAILED"
| fields timestamp, snowflake.task.name, snowflake.warehouse.name, snowflake.task.run.state
| sort timestamp desc
| limit 50

Rank Snowflake tasks by number of recorded runs.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "tasks"
| filter isNotNull(snowflake.task.name)
| summarize { runs = count() }, by: { snowflake.task.name }
| sort runs desc
| limit 25

Dynatrace Snowflake Observability Agent resource fields

Fields present on all Dynatrace Snowflake Observability Agent telemetry records. Synced with config.py RESOURCE_ATTRIBUTES.

Attribute	Type	Description	Examples
`db.system`	string	experimental Display name: `Database system` An identifier for the database management system (DBMS) product being used. See below for a list of well-known identifiers. ¹	`mongodb`; `mysql`
`deployment.environment`	string	resource deprecated Use deployment.environment.name instead. Display name: `Snowflake deployment environment` Deprecated alias for deployment.environment.name. The deployment environment, for example, production, staging, or development. Will be removed in release 1.3.0. ²	`PROD`
`deployment.environment.name`	string	resource stable Display name: `Snowflake deployment environment name` The deployment environment name (OTel semconv canonical field), for example, production, staging, or development. Emitted alongside deployment.environment during the deprecation window. ³	`PROD`
`deployment.environment.tag`	string	resource stable Display name: `Deployment environment tag` Optional tag for the deployment environment in multitenancy mode ⁴	`SA080`
`dsoa.run.context`	string	resource stable Display name: `Dynatrace Snowflake Observability Agent execution context` The name of the Dynatrace Snowflake Observability Agent context (part of plugin) used to produce the telemetry (logs, traces, metrics, or events). In case of multiple contexts within the same plugin, this helps differentiate between them. If plugin delivers only one context, this field will have the same value as the plugin name. ⁵	`users_all_roles`
`dsoa.run.id`	string	resource stable Display name: `Dynatrace Snowflake Observability Agent execution unique identifier` Unique ID of each execution of the Dynatrace Snowflake Observability Agent plugin. It can be used to differentiate between telemetry produced between two executions, for example, to calculate the change in the system. ⁶	`4aa7c76c-e98c-4b8b-a5b3-a8a721bbde2d`
`dsoa.run.plugin`	string	resource stable Display name: `Dynatrace Snowflake Observability Agent execution plugin name` The name of the Dynatrace Snowflake Observability Agent plugin that produced this telemetry. Use to filter all telemetry from a specific plugin (for example, 'query_history', 'warehouse_usage'). Distinct from dsoa.run.context, which may represent a sub-context within a plugin. ⁷	`users`
`host.name`	string	resource experimental Display name: `Host name` The host name as determined on the data source (for instance, OneAgent, extensions or OpenTelemetry). Important: This is not the name of the host entity, which can be modified based on naming rules. ⁸ Tags: `permission`	`ip-10-178-54-32.ec2.internal`
`service.name`	string	resource stable Display name: `OTel service name` The logical name of the service. ⁹	`shoppingcart`
`telemetry.exporter.name`	string	resource experimental Display name: `Telemetry exporter name` The exporter name. ¹⁰	`odin`
`telemetry.exporter.version`	string	resource experimental Display name: `Telemetry exporter version` The full agent/exporter version. ¹¹	`1.285.1.20240101-256988`

Always 'snowflake' for all Dynatrace Snowflake Observability Agent telemetry.

User-configured deployment environment label, for example, 'PROD', 'STG', or 'DEV'. Set via 'core.snowflake.deployment_environment'.

⁴

Optional user-defined tag for grouping Snowflake accounts in multitenancy mode, set via 'core.tag'.

⁵

Identifies the specific sub-context within the plugin (for example, 'query_history', 'users_all_roles').

⁶

Unique identifier for a single Dynatrace Snowflake Observability Agent execution run. Changes on every invocation.

⁷

The Dynatrace Snowflake Observability Agent plugin that produced this telemetry (for example, 'query_history', 'warehouse_usage').

⁸

The Snowflake account hostname (for example, 'xy12345.snowflakecomputing.com'), from 'core.snowflake.host_name'.

⁹

Always the Snowflake account identifier without '.snowflakecomputing.com' suffix (for example, 'myorg-myaccount').

¹⁰

Always 'dynatrace.snowagent' — identifies Dynatrace Snowflake Observability Agent as the telemetry exporter.

¹¹

The installed Dynatrace Snowflake Observability Agent version in <major>.<minor>.<patch>.<build> format.

db.system has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`adabas`	Adabas (Adaptable Database System)	Adabas
`amazon-documentdb`	Amazon DocumentDB	DocumentDB
`aurora-mysql`	Amazon Aurora MySQL	Aurora MySQL
`aurora-postgresql`	Amazon Aurora PostgreSQL	Aurora PostgreSQL
`cache`	InterSystems Caché	InterSystems Caché
`cassandra`	Apache Cassandra	Cassandra
`clickhouse`	ClickHouse	ClickHouse
`cloudscape`	Cloudscape	Cloudscape
`cockroachdb`	CockroachDB	CockroachDB
`coldfusion`	ColdFusion IMQ	ColdFusion IMQ
`cosmosdb`	Microsoft Azure Cosmos DB	Cosmos DB
`couchbase`	Couchbase	Couchbase
`couchdb`	CouchDB	CouchDB
`databricks`	Databricks Data Platform	Databricks Data Platform
`db2`	IBM Db2	IBM Db2
`derby`	Apache Derby	Derby
`dl/i`	IBM DL/I	IBM DL/I
`dynamodb`	Amazon DynamoDB	DynamoDB
`edb`	EnterpriseDB	EnterpriseDB
`elasticsearch`	Elasticsearch	Elasticsearch
`filemaker`	FileMaker	FileMaker
`firebird`	Firebird	Firebird
`firstsql`	FirstSQL	FirstSQL
`geode`	Apache Geode	Geode
`h2`	H2	H2
`hanadb`	SAP HANA	SAP HANA
`hbase`	Apache HBase	HBase
`hive`	Apache Hive	Hive
`hsqldb`	HyperSQL DataBase	HSQLDB
`informix`	Informix	Informix
`ingres`	Ingres	Ingres
`instantdb`	InstantDB	InstantDB
`interbase`	InterBase	InterBase
`keyspaces-cassandra`	Amazon Keyspaces for Apache Cassandra	Keyspaces
`mariadb`	MariaDB	MariaDB
`maxdb`	SAP MaxDB	SAP MaxDB
`memcached`	Memcached	Memcached
`mongodb`	MongoDB	MongoDB
`mssql`	Microsoft SQL Server	SQL Server
`mssqlcompact`	Microsoft SQL Server Compact	SQL Server Compact
`mysql`	MySQL	MySQL
`neo4j`	Neo4j	Neo4j
`neptune`	Amazon Neptune	Neptune
`netezza`	Netezza	Netezza
`opensearch`	OpenSearch	OpenSearch
`oracle`	Oracle Database	Oracle
`other_sql`	Some other SQL database. Fallback only. See notes.	Other SQL
`pervasive`	Pervasive PSQL	Pervasive PSQL
`phoenix`	Apache Phoenix	Apache Phoenix
`pointbase`	PointBase	PointBase
`postgresql`	PostgreSQL	PostgreSQL
`progress`	Progress Database	Progress
`redis`	Redis	Redis
`redshift`	Amazon Redshift	Redshift
`snowflake`	Snowflake Data Platform	Snowflake Data Platform
`spanner`	Cloud Spanner	Cloud Spanner
`sqlite`	SQLite	SQLite
`sybase`	Sybase	Sybase
`teradata`	Teradata	Teradata
`valkey`	Valkey	Valkey
`vertica`	Vertica	Vertica

Tasks log record fields

Attribute fields for tasks log records.

Attribute	Type	Description	Examples
`snowflake.task.condition`	string	experimental Display name: `Snowflake task condition text` The condition text of the task.	`status = 'SUCCESS'`
`snowflake.task.config.allow_overlap`	boolean	experimental Display name: `Snowflake task overlapping execution indicator` Indicates if overlapping execution is allowed.	`true`
`snowflake.task.config.id`	string	experimental Display name: `Snowflake task configuration ID` The configuration of the task.	`config123`
`snowflake.task.end_time`	long	experimental Display name: `Snowflake task end time` The end time of the task.	`1633046700000000000`
`snowflake.task.error_integration`	string	experimental Display name: `Snowflake task error notification integration service` Name of the notification integration used to access Amazon Simple Notification Service (SNS), Google Pub/Sub, or Microsoft Azure Event Grid to relay error notifications for the task.	`error_integration123`
`snowflake.task.graph.root_id`	string	experimental Display name: `Snowflake task graph root ID` The root ID of the task graph.	`root123`
`snowflake.task.graph.version`	long	experimental Display name: `Snowflake task graph version` The version of the task graph.	`1`
`snowflake.task.id`	long	experimental Display name: `Snowflake task ID` The unique identifier for the task.	`123456789`
`snowflake.task.instance_id`	long	stable Display name: `Snowflake internal instance ID` Internal/system-generated identifier for the instance which the object belongs to.	`987654321`
`snowflake.task.last_committed_on`	long	experimental Display name: `Snowflake task last committed time` The last committed time of the task.	`1633046400000000000`
`snowflake.task.last_suspended_on`	long	experimental Display name: `Snowflake task last suspended time` The last suspended time of the task.	`1633046700000000000`
`snowflake.task.owner`	string	experimental Display name: `Snowflake task owner` The owner of the task.	`admin`
`snowflake.task.predecessors`	string[]	experimental Display name: `Snowflake task predecessors` The predecessors of the task.	`['taskA', 'taskB']`
`snowflake.task.run.attempt`	long	stable Display name: `Snowflake task run attempt number` The attempt number of the task run.	`1`
`snowflake.task.run.completed_time`	long	stable Display name: `Snowflake task run completion time` The completed time of the task run.	`1742824007586000000`
`snowflake.task.run.group_id`	string	experimental Display name: `Snowflake task run group ID` The group ID of the task run.	`group123`
`snowflake.task.run.id`	long	experimental Display name: `Snowflake task run ID` The unique identifier for the task run.	`123456`
`snowflake.task.run.return_value`	string	experimental Display name: `Snowflake predecessor task return value` Value set for the predecessor task in a task graph. The return value is explicitly set by calling the SYSTEM$SET_RETURN_VALUE function by the predecessor task.	`0`
`snowflake.task.run.scheduled_from`	string	stable Display name: `Snowflake task run schedule source` The source from which the task was scheduled.	`CRON`
`snowflake.task.run.scheduled_time`	long	stable Display name: `Snowflake task run scheduled time` The scheduled time of the task run.	`1742821828016000000`
`snowflake.task.run.state`	string	stable Display name: `Snowflake task run state` The state of the task run.	`RUNNING`
`snowflake.task.schedule`	string	experimental Display name: `Snowflake task schedule` The schedule of the task.	`0 0 * * *`
`snowflake.task.start_time`	long	experimental Display name: `Snowflake task start time` The start time of the task.	`1633046400000000000`

Snowflake users log records

Log records emitted by the Dynatrace Snowflake Observability Agent users plugin.

Query

Fetch the 100 most recent Dynatrace Snowflake Observability Agent users plugin log entries from Grail.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "users"
| sort timestamp desc
| limit 100

Fetch log entries for disabled Snowflake users from the users plugin.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "users"
| filter snowflake.user.is_disabled == "true"
| sort timestamp desc
| limit 50

Fetch log entries for Snowflake users without MFA enabled.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "users"
| filter snowflake.user.has_mfa == "false"
| sort timestamp desc
| limit 50

Dynatrace Snowflake Observability Agent resource fields

Fields present on all Dynatrace Snowflake Observability Agent telemetry records. Synced with config.py RESOURCE_ATTRIBUTES.

Attribute	Type	Description	Examples
`db.system`	string	experimental Display name: `Database system` An identifier for the database management system (DBMS) product being used. See below for a list of well-known identifiers. ¹	`mongodb`; `mysql`
`deployment.environment`	string	resource deprecated Use deployment.environment.name instead. Display name: `Snowflake deployment environment` Deprecated alias for deployment.environment.name. The deployment environment, for example, production, staging, or development. Will be removed in release 1.3.0. ²	`PROD`
`deployment.environment.name`	string	resource stable Display name: `Snowflake deployment environment name` The deployment environment name (OTel semconv canonical field), for example, production, staging, or development. Emitted alongside deployment.environment during the deprecation window. ³	`PROD`
`deployment.environment.tag`	string	resource stable Display name: `Deployment environment tag` Optional tag for the deployment environment in multitenancy mode ⁴	`SA080`
`dsoa.run.context`	string	resource stable Display name: `Dynatrace Snowflake Observability Agent execution context` The name of the Dynatrace Snowflake Observability Agent context (part of plugin) used to produce the telemetry (logs, traces, metrics, or events). In case of multiple contexts within the same plugin, this helps differentiate between them. If plugin delivers only one context, this field will have the same value as the plugin name. ⁵	`users_all_roles`
`dsoa.run.id`	string	resource stable Display name: `Dynatrace Snowflake Observability Agent execution unique identifier` Unique ID of each execution of the Dynatrace Snowflake Observability Agent plugin. It can be used to differentiate between telemetry produced between two executions, for example, to calculate the change in the system. ⁶	`4aa7c76c-e98c-4b8b-a5b3-a8a721bbde2d`
`dsoa.run.plugin`	string	resource stable Display name: `Dynatrace Snowflake Observability Agent execution plugin name` The name of the Dynatrace Snowflake Observability Agent plugin that produced this telemetry. Use to filter all telemetry from a specific plugin (for example, 'query_history', 'warehouse_usage'). Distinct from dsoa.run.context, which may represent a sub-context within a plugin. ⁷	`users`
`host.name`	string	resource experimental Display name: `Host name` The host name as determined on the data source (for instance, OneAgent, extensions or OpenTelemetry). Important: This is not the name of the host entity, which can be modified based on naming rules. ⁸ Tags: `permission`	`ip-10-178-54-32.ec2.internal`
`service.name`	string	resource stable Display name: `OTel service name` The logical name of the service. ⁹	`shoppingcart`
`telemetry.exporter.name`	string	resource experimental Display name: `Telemetry exporter name` The exporter name. ¹⁰	`odin`
`telemetry.exporter.version`	string	resource experimental Display name: `Telemetry exporter version` The full agent/exporter version. ¹¹	`1.285.1.20240101-256988`

Always 'snowflake' for all Dynatrace Snowflake Observability Agent telemetry.

User-configured deployment environment label, for example, 'PROD', 'STG', or 'DEV'. Set via 'core.snowflake.deployment_environment'.

⁴

Optional user-defined tag for grouping Snowflake accounts in multitenancy mode, set via 'core.tag'.

⁵

Identifies the specific sub-context within the plugin (for example, 'query_history', 'users_all_roles').

⁶

Unique identifier for a single Dynatrace Snowflake Observability Agent execution run. Changes on every invocation.

⁷

The Dynatrace Snowflake Observability Agent plugin that produced this telemetry (for example, 'query_history', 'warehouse_usage').

⁸

The Snowflake account hostname (for example, 'xy12345.snowflakecomputing.com'), from 'core.snowflake.host_name'.

⁹

Always the Snowflake account identifier without '.snowflakecomputing.com' suffix (for example, 'myorg-myaccount').

¹⁰

Always 'dynatrace.snowagent' — identifies Dynatrace Snowflake Observability Agent as the telemetry exporter.

¹¹

The installed Dynatrace Snowflake Observability Agent version in <major>.<minor>.<patch>.<build> format.

db.system has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`adabas`	Adabas (Adaptable Database System)	Adabas
`amazon-documentdb`	Amazon DocumentDB	DocumentDB
`aurora-mysql`	Amazon Aurora MySQL	Aurora MySQL
`aurora-postgresql`	Amazon Aurora PostgreSQL	Aurora PostgreSQL
`cache`	InterSystems Caché	InterSystems Caché
`cassandra`	Apache Cassandra	Cassandra
`clickhouse`	ClickHouse	ClickHouse
`cloudscape`	Cloudscape	Cloudscape
`cockroachdb`	CockroachDB	CockroachDB
`coldfusion`	ColdFusion IMQ	ColdFusion IMQ
`cosmosdb`	Microsoft Azure Cosmos DB	Cosmos DB
`couchbase`	Couchbase	Couchbase
`couchdb`	CouchDB	CouchDB
`databricks`	Databricks Data Platform	Databricks Data Platform
`db2`	IBM Db2	IBM Db2
`derby`	Apache Derby	Derby
`dl/i`	IBM DL/I	IBM DL/I
`dynamodb`	Amazon DynamoDB	DynamoDB
`edb`	EnterpriseDB	EnterpriseDB
`elasticsearch`	Elasticsearch	Elasticsearch
`filemaker`	FileMaker	FileMaker
`firebird`	Firebird	Firebird
`firstsql`	FirstSQL	FirstSQL
`geode`	Apache Geode	Geode
`h2`	H2	H2
`hanadb`	SAP HANA	SAP HANA
`hbase`	Apache HBase	HBase
`hive`	Apache Hive	Hive
`hsqldb`	HyperSQL DataBase	HSQLDB
`informix`	Informix	Informix
`ingres`	Ingres	Ingres
`instantdb`	InstantDB	InstantDB
`interbase`	InterBase	InterBase
`keyspaces-cassandra`	Amazon Keyspaces for Apache Cassandra	Keyspaces
`mariadb`	MariaDB	MariaDB
`maxdb`	SAP MaxDB	SAP MaxDB
`memcached`	Memcached	Memcached
`mongodb`	MongoDB	MongoDB
`mssql`	Microsoft SQL Server	SQL Server
`mssqlcompact`	Microsoft SQL Server Compact	SQL Server Compact
`mysql`	MySQL	MySQL
`neo4j`	Neo4j	Neo4j
`neptune`	Amazon Neptune	Neptune
`netezza`	Netezza	Netezza
`opensearch`	OpenSearch	OpenSearch
`oracle`	Oracle Database	Oracle
`other_sql`	Some other SQL database. Fallback only. See notes.	Other SQL
`pervasive`	Pervasive PSQL	Pervasive PSQL
`phoenix`	Apache Phoenix	Apache Phoenix
`pointbase`	PointBase	PointBase
`postgresql`	PostgreSQL	PostgreSQL
`progress`	Progress Database	Progress
`redis`	Redis	Redis
`redshift`	Amazon Redshift	Redshift
`snowflake`	Snowflake Data Platform	Snowflake Data Platform
`spanner`	Cloud Spanner	Cloud Spanner
`sqlite`	SQLite	SQLite
`sybase`	Sybase	Sybase
`teradata`	Teradata	Teradata
`valkey`	Valkey	Valkey
`vertica`	Vertica	Vertica

Users log record fields

Attribute fields for users log records.

Attribute	Type	Description	Examples
`snowflake.user.bypass_mfa_until`	long	experimental Display name: `Snowflake user MFA bypass time` The time until which the user can bypass MFA. Epoch nanoseconds timestamp.	`1620213179885000000`
`snowflake.user.comment`	string	experimental Display name: `Snowflake user comment` Any comments associated with the user.	`New user account`
`snowflake.user.default.namespace`	string	stable Display name: `Snowflake user default namespace` The default namespace for the user.	`PUBLIC`
`snowflake.user.default.role`	string	stable Display name: `Snowflake user default role` The default role for the user.	`SYSADMIN`
`snowflake.user.default.secondary_role`	string	stable Display name: `Snowflake user default secondary role` The default secondary role for the user.	`SECURITYADMIN`
`snowflake.user.default.warehouse`	string	stable Display name: `Snowflake user default warehouse` The default warehouse for the user.	`COMPUTE_WH`
`snowflake.user.display_name`	string	experimental Display name: `Snowflake user display name` The display name of the user.	`John Doe`
`snowflake.user.email`	string	experimental Display name: `Snowflake user email address` The email address of the user.	`jdoe@example.com`
`snowflake.user.expires_at`	long	experimental Display name: `Snowflake user account expiration time` The expiration date of the user account.	`1620213179885000000`
`snowflake.user.ext_authn.duo`	boolean	stable Display name: `Snowflake user Duo authentication indicator` Indicates if Duo authentication is enabled for the user.	`true`
`snowflake.user.ext_authn.uid`	string	stable Display name: `Snowflake user ID in external authentication` The external authentication UID for the user.	`ext123`
`snowflake.user.has_mfa`	boolean	stable Display name: `Snowflake user MFA enrollment indicator` Indicates if the user is enrolled for multi-factor authentication.	`true`
`snowflake.user.has_password`	boolean	stable Display name: `Snowflake user password indicator` Indicates if the user has a password set.	`true`
`snowflake.user.has_pat`	boolean	stable Display name: `Snowflake user programmatic access token indicator` Indicates if a programmatic access token has been generated for the user.	`true`
`snowflake.user.has_rsa`	boolean	stable Display name: `Snowflake user RSA key authentication indicator` Indicates if RSA public key authentication is configured for the user.	`true`
`snowflake.user.has_workload_identity`	boolean	experimental Display name: `Snowflake user workload identity indicator` Indicates if workload identity federation is configured for the user.	`true`
`snowflake.user.id`	long	experimental Display name: `Snowflake user ID` The unique identifier for the user.	`12345`
`snowflake.user.is_disabled`	boolean	stable Display name: `Snowflake user disabled indicator` Indicates if the user account is disabled.	`false`
`snowflake.user.is_from_organization`	boolean	experimental Display name: `Snowflake user organization import indicator` Indicates if the user was imported from a global organization.	`true`
`snowflake.user.is_locked`	boolean	stable Display name: `Snowflake user locked indicator` Indicates if the user account is locked by Snowflake.	`false`
`snowflake.user.locked_until_time`	long	experimental Display name: `Snowflake user locked until time` The time until which the user account is locked.	`1615479617866000000`
`snowflake.user.must_change_password`	boolean	experimental Display name: `Snowflake user password change required indicator` Indicates if the user must change their password.	`true`
`snowflake.user.name.first`	string	stable Display name: `Snowflake user first name` The first name of the user.	`John`
`snowflake.user.name.last`	string	stable Display name: `Snowflake user last name` The last name of the user.	`Doe`
`snowflake.user.name.login`	string	experimental Display name: `Snowflake user login name` The login name of the user.	`jdoe`
`snowflake.user.owner`	string	stable Display name: `Snowflake user owner role` The role that owns the user account.	`ACCOUNTADMIN`
`snowflake.user.privilege.granted_by`	string[]	experimental Display name: `Snowflake user privilege grantor roles` Array of all roles which granted grants to a user for a privilege. ¹	`['ACCOUNTADMIN']`
`snowflake.user.privilege.grants_on`	string[]	experimental Display name: `Snowflake user privilege grant targets` List of all objects of given type on which given privilege was given; both object type and privilege are reported as `snowflake.user.privilege.name` ²	`['TRUST_CENTER_ADMIN', 'COMPUTE_WH']`
`snowflake.user.privilege.name`	string	stable Display name: `Snowflake user privilege name` Name of the privilege and type of object this privilege granted on to the user or role. Composed as `privilege:granted_on_object`.	`CREATE SERVICE:SCHEMA`
`snowflake.user.roles.all`	string	experimental Display name: `Snowflake user roles` Comma separated list of all roles granted to a user.	`SNOWFLAKE_FINANCE,MONITORING`
`snowflake.user.roles.direct.list`	string[]	stable Display name: `Snowflake user direct roles` List of all direct roles granted to user. ³	`['DEVOPS_ROLE', 'SYSADMIN', 'ACCOUNTADMIN']`
`snowflake.user.roles.direct.removed`	string	stable Display name: `Snowflake user removed direct role` Name of the role that was revoked from user.	`ACCOUNTADMIN`
`snowflake.user.roles.granted_by`	string[]	experimental Display name: `Snowflake user role grantor roles` Array of admin roles that were used to grant current list of user roles. ⁴	`['DEMIGOD', 'SECURITYADMIN', 'ACCOUNTADMIN']`

Array of grantor role names stored as string[] in Grail.

Array of privilege grant target names stored as string[] in Grail.

Array of directly assigned role names stored as string[] in Grail.

⁴

Array of grantor names for role assignments stored as string[] in Grail.

Snowflake warehouse usage log records

Log records emitted by the Dynatrace Snowflake Observability Agent warehouse_usage plugin.

Query

Fetch the 100 most recent Dynatrace Snowflake Observability Agent warehouse_usage plugin log entries from Grail.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "warehouse_usage"
| sort timestamp desc
| limit 100

Inspect Snowflake warehouse state-change events (start, resume, suspend) from the warehouse_usage plugin.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "warehouse_usage"
| filter isNotNull(snowflake.warehouse.name)
| fields timestamp, snowflake.warehouse.name, snowflake.warehouse.event.name, snowflake.warehouse.event.state
| sort timestamp desc
| limit 50

Count Snowflake warehouse state-change events grouped by warehouse and event type.

fetch logs
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "warehouse_usage"
| filter isNotNull(snowflake.warehouse.name)
| summarize { events = count() }, by: { snowflake.warehouse.name, snowflake.warehouse.event.name }
| sort events desc
| limit 25

Dynatrace Snowflake Observability Agent resource fields

Fields present on all Dynatrace Snowflake Observability Agent telemetry records. Synced with config.py RESOURCE_ATTRIBUTES.

Attribute	Type	Description	Examples
`db.system`	string	experimental Display name: `Database system` An identifier for the database management system (DBMS) product being used. See below for a list of well-known identifiers. ¹	`mongodb`; `mysql`
`deployment.environment`	string	resource deprecated Use deployment.environment.name instead. Display name: `Snowflake deployment environment` Deprecated alias for deployment.environment.name. The deployment environment, for example, production, staging, or development. Will be removed in release 1.3.0. ²	`PROD`
`deployment.environment.name`	string	resource stable Display name: `Snowflake deployment environment name` The deployment environment name (OTel semconv canonical field), for example, production, staging, or development. Emitted alongside deployment.environment during the deprecation window. ³	`PROD`
`deployment.environment.tag`	string	resource stable Display name: `Deployment environment tag` Optional tag for the deployment environment in multitenancy mode ⁴	`SA080`
`dsoa.run.context`	string	resource stable Display name: `Dynatrace Snowflake Observability Agent execution context` The name of the Dynatrace Snowflake Observability Agent context (part of plugin) used to produce the telemetry (logs, traces, metrics, or events). In case of multiple contexts within the same plugin, this helps differentiate between them. If plugin delivers only one context, this field will have the same value as the plugin name. ⁵	`users_all_roles`
`dsoa.run.id`	string	resource stable Display name: `Dynatrace Snowflake Observability Agent execution unique identifier` Unique ID of each execution of the Dynatrace Snowflake Observability Agent plugin. It can be used to differentiate between telemetry produced between two executions, for example, to calculate the change in the system. ⁶	`4aa7c76c-e98c-4b8b-a5b3-a8a721bbde2d`
`dsoa.run.plugin`	string	resource stable Display name: `Dynatrace Snowflake Observability Agent execution plugin name` The name of the Dynatrace Snowflake Observability Agent plugin that produced this telemetry. Use to filter all telemetry from a specific plugin (for example, 'query_history', 'warehouse_usage'). Distinct from dsoa.run.context, which may represent a sub-context within a plugin. ⁷	`users`
`host.name`	string	resource experimental Display name: `Host name` The host name as determined on the data source (for instance, OneAgent, extensions or OpenTelemetry). Important: This is not the name of the host entity, which can be modified based on naming rules. ⁸ Tags: `permission`	`ip-10-178-54-32.ec2.internal`
`service.name`	string	resource stable Display name: `OTel service name` The logical name of the service. ⁹	`shoppingcart`
`telemetry.exporter.name`	string	resource experimental Display name: `Telemetry exporter name` The exporter name. ¹⁰	`odin`
`telemetry.exporter.version`	string	resource experimental Display name: `Telemetry exporter version` The full agent/exporter version. ¹¹	`1.285.1.20240101-256988`

Always 'snowflake' for all Dynatrace Snowflake Observability Agent telemetry.

User-configured deployment environment label, for example, 'PROD', 'STG', or 'DEV'. Set via 'core.snowflake.deployment_environment'.

⁴

Optional user-defined tag for grouping Snowflake accounts in multitenancy mode, set via 'core.tag'.

⁵

Identifies the specific sub-context within the plugin (for example, 'query_history', 'users_all_roles').

⁶

Unique identifier for a single Dynatrace Snowflake Observability Agent execution run. Changes on every invocation.

⁷

The Dynatrace Snowflake Observability Agent plugin that produced this telemetry (for example, 'query_history', 'warehouse_usage').

⁸

The Snowflake account hostname (for example, 'xy12345.snowflakecomputing.com'), from 'core.snowflake.host_name'.

⁹

Always the Snowflake account identifier without '.snowflakecomputing.com' suffix (for example, 'myorg-myaccount').

¹⁰

Always 'dynatrace.snowagent' — identifies Dynatrace Snowflake Observability Agent as the telemetry exporter.

¹¹

The installed Dynatrace Snowflake Observability Agent version in <major>.<minor>.<patch>.<build> format.

db.system has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`adabas`	Adabas (Adaptable Database System)	Adabas
`amazon-documentdb`	Amazon DocumentDB	DocumentDB
`aurora-mysql`	Amazon Aurora MySQL	Aurora MySQL
`aurora-postgresql`	Amazon Aurora PostgreSQL	Aurora PostgreSQL
`cache`	InterSystems Caché	InterSystems Caché
`cassandra`	Apache Cassandra	Cassandra
`clickhouse`	ClickHouse	ClickHouse
`cloudscape`	Cloudscape	Cloudscape
`cockroachdb`	CockroachDB	CockroachDB
`coldfusion`	ColdFusion IMQ	ColdFusion IMQ
`cosmosdb`	Microsoft Azure Cosmos DB	Cosmos DB
`couchbase`	Couchbase	Couchbase
`couchdb`	CouchDB	CouchDB
`databricks`	Databricks Data Platform	Databricks Data Platform
`db2`	IBM Db2	IBM Db2
`derby`	Apache Derby	Derby
`dl/i`	IBM DL/I	IBM DL/I
`dynamodb`	Amazon DynamoDB	DynamoDB
`edb`	EnterpriseDB	EnterpriseDB
`elasticsearch`	Elasticsearch	Elasticsearch
`filemaker`	FileMaker	FileMaker
`firebird`	Firebird	Firebird
`firstsql`	FirstSQL	FirstSQL
`geode`	Apache Geode	Geode
`h2`	H2	H2
`hanadb`	SAP HANA	SAP HANA
`hbase`	Apache HBase	HBase
`hive`	Apache Hive	Hive
`hsqldb`	HyperSQL DataBase	HSQLDB
`informix`	Informix	Informix
`ingres`	Ingres	Ingres
`instantdb`	InstantDB	InstantDB
`interbase`	InterBase	InterBase
`keyspaces-cassandra`	Amazon Keyspaces for Apache Cassandra	Keyspaces
`mariadb`	MariaDB	MariaDB
`maxdb`	SAP MaxDB	SAP MaxDB
`memcached`	Memcached	Memcached
`mongodb`	MongoDB	MongoDB
`mssql`	Microsoft SQL Server	SQL Server
`mssqlcompact`	Microsoft SQL Server Compact	SQL Server Compact
`mysql`	MySQL	MySQL
`neo4j`	Neo4j	Neo4j
`neptune`	Amazon Neptune	Neptune
`netezza`	Netezza	Netezza
`opensearch`	OpenSearch	OpenSearch
`oracle`	Oracle Database	Oracle
`other_sql`	Some other SQL database. Fallback only. See notes.	Other SQL
`pervasive`	Pervasive PSQL	Pervasive PSQL
`phoenix`	Apache Phoenix	Apache Phoenix
`pointbase`	PointBase	PointBase
`postgresql`	PostgreSQL	PostgreSQL
`progress`	Progress Database	Progress
`redis`	Redis	Redis
`redshift`	Amazon Redshift	Redshift
`snowflake`	Snowflake Data Platform	Snowflake Data Platform
`spanner`	Cloud Spanner	Cloud Spanner
`sqlite`	SQLite	SQLite
`sybase`	Sybase	Sybase
`teradata`	Teradata	Teradata
`valkey`	Valkey	Valkey
`vertica`	Vertica	Vertica

Warehouse usage log record fields

Attribute fields for warehouse usage log records.

Attribute	Type	Description	Examples
`snowflake.warehouse.clusters.count`	long	resource stable Display name: `Snowflake warehouse cluster count` The number of clusters in the warehouse. ¹	`2`
`snowflake.warehouse.event.reason`	string	experimental Display name: `Snowflake warehouse event reason` The reason for the event.	`USER_REQUEST`

The .count suffix is deliberately preserved. Sibling metrics snowflake.warehouse.clusters.min, .max, and .started exist in the same namespace; using the bare plural snowflake.warehouse.clusters as a scalar would be ambiguous alongside them.

Snowflake log records

Query

Snowflake Resource Monitors log records

Query

Dynatrace Snowflake Observability Agent resource fields

Resource Monitors log record fields

Snowflake Snowpipes log records

Query

Dynatrace Snowflake Observability Agent resource fields

Snowpipes log record fields

Snowflake Trust Center log records

Query

Dynatrace Snowflake Observability Agent resource fields

Trust Center log record fields

Snowflake active queries log records

Query

Dynatrace Snowflake Observability Agent resource fields

Active queries log record fields

Snowflake budgets log records

Query

Dynatrace Snowflake Observability Agent resource fields

Budgets log record fields

Snowflake cold tables log records

Query

Dynatrace Snowflake Observability Agent resource fields

Cold tables log record fields

Snowflake data schemas log records

Query

Dynatrace Snowflake Observability Agent resource fields

Data schemas log record fields

Snowflake dynamic tables log records

Query

Dynatrace Snowflake Observability Agent resource fields

Dynamic tables log record fields

Snowflake login history log records

Query

Dynatrace Snowflake Observability Agent resource fields

Login history log record fields

Snowflake metering log records

Query

Dynatrace Snowflake Observability Agent resource fields

Metering log record fields

Snowflake organization costs log records

Query

Dynatrace Snowflake Observability Agent resource fields

Organization costs log record fields

Snowflake query history log records

Query

Dynatrace Snowflake Observability Agent resource fields

Query history log record fields

Snowflake shares log records

Query

Dynatrace Snowflake Observability Agent resource fields

Shares log record fields

Snowflake tasks log records

Query

Dynatrace Snowflake Observability Agent resource fields

Tasks log record fields

Snowflake users log records

Query

Dynatrace Snowflake Observability Agent resource fields

Users log record fields

Snowflake warehouse usage log records

Query

Dynatrace Snowflake Observability Agent resource fields

Warehouse usage log record fields