Try it free

Snowflake spans

  • Latest Dynatrace
  • Reference

Span records emitted by Dynatrace Snowflake Observability Agent plugins from Snowflake ACCOUNT_USAGE views.

Query

Fetch the 50 most recent Dynatrace Snowflake Observability Agent event_log spans (traced records from the Snowflake event table).

fetch spans
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "event_log"
| sort timestamp desc
| limit 50

Inspect event_log spans correlated to a Snowflake query, including warehouse and role context.

fetch spans
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "event_log"
| filter isNotNull(snowflake.query.id)
| fields timestamp, snowflake.query.id, snowflake.warehouse.name, snowflake.role.name
| sort timestamp desc
| limit 50

Count event_log spans grouped by warehouse.

fetch spans
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "event_log"
| filter isNotNull(snowflake.warehouse.name)
| summarize { spans = count() }, by: { snowflake.warehouse.name }
| sort spans desc

Snowflake event log spans

Span records emitted by the Dynatrace Snowflake Observability Agent event_log plugin.

Query

Fetch the 50 most recent Dynatrace Snowflake Observability Agent event_log spans (traced records from the Snowflake event table).

fetch spans
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "event_log"
| sort timestamp desc
| limit 50

Inspect event_log spans correlated to a Snowflake query, including warehouse and role context.

fetch spans
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "event_log"
| filter isNotNull(snowflake.query.id)
| fields timestamp, snowflake.query.id, snowflake.warehouse.name, snowflake.role.name
| sort timestamp desc
| limit 50

Count event_log spans grouped by warehouse.

fetch spans
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "event_log"
| filter isNotNull(snowflake.warehouse.name)
| summarize { spans = count() }, by: { snowflake.warehouse.name }
| sort spans desc

Dynatrace Snowflake Observability Agent resource fields

Fields present on all Dynatrace Snowflake Observability Agent telemetry records. Synced with config.py RESOURCE_ATTRIBUTES.

AttributeTypeDescriptionExamples

db.system

string

experimental
Display name: Database system
An identifier for the database management system (DBMS) product being used. See below for a list of well-known identifiers. 1

mongodb; mysql

deployment.environment

string

resource deprecatedUse deployment.environment.name instead.
Deprecated alias for deployment.environment.name. The deployment environment, for example, production, staging, or development. Will be removed in release 1.3.0. 2

PROD

deployment.environment.name

string

resource stable
The deployment environment name (OTel semconv canonical field), for example, production, staging, or development. Emitted alongside deployment.environment during the deprecation window. 3

PROD

deployment.environment.tag

string

resource stable
Optional tag for the deployment environment in multitenancy mode 4

SA080

dsoa.run.context

string

resource stable
The name of the Dynatrace Snowflake Observability Agent context (part of plugin) used to produce the telemetry (logs, traces, metrics, or events). In case of multiple contexts within the same plugin, this helps differentiate between them. If plugin delivers only one context, this field will have the same value as the plugin name. 5

users_all_roles

dsoa.run.id

string

resource stable
Unique ID of each execution of the Dynatrace Snowflake Observability Agent plugin. It can be used to differentiate between telemetry produced between two executions, for example, to calculate the change in the system. 6

4aa7c76c-e98c-4b8b-a5b3-a8a721bbde2d

dsoa.run.plugin

string

resource stable
The name of the Dynatrace Snowflake Observability Agent plugin that produced this telemetry. Use to filter all telemetry from a specific plugin (for example, 'query_history', 'warehouse_usage'). Distinct from dsoa.run.context, which may represent a sub-context within a plugin. 7

users

host.name

string

resource experimental
Display name: Host name
The host name as determined on the data source (for instance, OneAgent, extensions or OpenTelemetry).
Important: This is not the name of the host entity, which can be modified based on naming rules. 8
Tags: permission

ip-10-178-54-32.ec2.internal

service.name

string

resource stable
Display name: OTel service name
The logical name of the service. 9

shoppingcart

telemetry.exporter.name

string

resource experimental
Display name: Telemetry exporter name
The exporter name. 10

odin

telemetry.exporter.version

string

resource experimental
Display name: Telemetry exporter version
The full agent/exporter version. 11

1.285.1.20240101-256988

1

Always 'snowflake' for all Dynatrace Snowflake Observability Agent telemetry.

2

User-configured deployment environment label, for example, 'PROD', 'STG', or 'DEV'. Set via 'core.snowflake.deployment_environment'.

3

User-configured deployment environment label (OTel-stable canonical key), for example, 'PROD', 'STG', or 'DEV'. Set via 'core.snowflake.deployment_environment'. Prefer this key over the deprecated deployment.environment alias.

4

Optional user-defined tag for grouping Snowflake accounts in multitenancy mode, set via 'core.tag'.

5

Identifies the specific sub-context within the plugin (for example, 'query_history', 'users_all_roles').

6

Unique identifier for a single Dynatrace Snowflake Observability Agent execution run. Changes on every invocation.

7

The Dynatrace Snowflake Observability Agent plugin that produced this telemetry (for example, 'query_history', 'warehouse_usage').

8

The Snowflake account hostname (for example, 'xy12345.snowflakecomputing.com'), from 'core.snowflake.host_name'.

9

Always the Snowflake account identifier without '.snowflakecomputing.com' suffix (for example, 'myorg-myaccount').

10

Always 'dynatrace.snowagent' — identifies Dynatrace Snowflake Observability Agent as the telemetry exporter.

11

The installed Dynatrace Snowflake Observability Agent version in <major>.<minor>.<patch>.<build> format.

db.system has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

ValueDescriptionDisplay name

adabas

Adabas (Adaptable Database System)

Adabas

amazon-documentdb

Amazon DocumentDB

DocumentDB

aurora-mysql

Amazon Aurora MySQL

Aurora MySQL

aurora-postgresql

Amazon Aurora PostgreSQL

Aurora PostgreSQL

cache

InterSystems Caché

InterSystems Caché

cassandra

Apache Cassandra

Cassandra

clickhouse

ClickHouse

ClickHouse

cloudscape

Cloudscape

Cloudscape

cockroachdb

CockroachDB

CockroachDB

coldfusion

ColdFusion IMQ

ColdFusion IMQ

cosmosdb

Microsoft Azure Cosmos DB

Cosmos DB

couchbase

Couchbase

Couchbase

couchdb

CouchDB

CouchDB

databricks

Databricks Data Platform

Databricks Data Platform

db2

IBM Db2

IBM Db2

derby

Apache Derby

Derby

dl/i

IBM DL/I

IBM DL/I

dynamodb

Amazon DynamoDB

DynamoDB

edb

EnterpriseDB

EnterpriseDB

elasticsearch

Elasticsearch

Elasticsearch

filemaker

FileMaker

FileMaker

firebird

Firebird

Firebird

firstsql

FirstSQL

FirstSQL

geode

Apache Geode

Geode

h2

H2

H2

hanadb

SAP HANA

SAP HANA

hbase

Apache HBase

HBase

hive

Apache Hive

Hive

hsqldb

HyperSQL DataBase

HSQLDB

informix

Informix

Informix

ingres

Ingres

Ingres

instantdb

InstantDB

InstantDB

interbase

InterBase

InterBase

keyspaces-cassandra

Amazon Keyspaces for Apache Cassandra

Keyspaces

mariadb

MariaDB

MariaDB

maxdb

SAP MaxDB

SAP MaxDB

memcached

Memcached

Memcached

mongodb

MongoDB

MongoDB

mssql

Microsoft SQL Server

SQL Server

mssqlcompact

Microsoft SQL Server Compact

SQL Server Compact

mysql

MySQL

MySQL

neo4j

Neo4j

Neo4j

neptune

Amazon Neptune

Neptune

netezza

Netezza

Netezza

opensearch

OpenSearch

OpenSearch

oracle

Oracle Database

Oracle

other_sql

Some other SQL database. Fallback only. See notes.

Other SQL

pervasive

Pervasive PSQL

Pervasive PSQL

phoenix

Apache Phoenix

Apache Phoenix

pointbase

PointBase

PointBase

postgresql

PostgreSQL

PostgreSQL

progress

Progress Database

Progress

redis

Redis

Redis

redshift

Amazon Redshift

Redshift

snowflake

Snowflake Data Platform

Snowflake Data Platform

spanner

Cloud Spanner

Cloud Spanner

sqlite

SQLite

SQLite

sybase

Sybase

Sybase

teradata

Teradata

Teradata

valkey

Valkey

Valkey

vertica

Vertica

Vertica

Snowflake query history spans

Span records emitted by the Dynatrace Snowflake Observability Agent query_history plugin.

Query

Fetch the 50 most recent Dynatrace Snowflake Observability Agent query_history spans (individual Snowflake query executions).

fetch spans
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "query_history"
| sort timestamp desc
| limit 50

Correlate Dynatrace Snowflake Observability Agent query_history spans by trace.id/span.id to inspect the root span and timing for a Snowflake query execution.

fetch spans
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "query_history"
| filter isNotNull(trace.id) and isNotNull(span.id)
| fields trace.id, span.id, request.is_root_span, snowflake.query.id, start_time, end_time
| sort start_time desc
| limit 50

Inspect Snowflake query-plan step/operator span events (snowflake.query.step.*) recorded on query_history spans.

fetch spans
| filter db.system == "snowflake"
| filter dsoa.run.plugin == "query_history"
| expand span.events
| filter contains(span.events.name, "snowflake.query.step")
| fields snowflake.query.step.id, snowflake.query.step.operator.type, snowflake.query.step.operator.stats, span.events.timestamp
| sort span.events.timestamp desc
| limit 100

Dynatrace Snowflake Observability Agent resource fields

Fields present on all Dynatrace Snowflake Observability Agent telemetry records. Synced with config.py RESOURCE_ATTRIBUTES.

AttributeTypeDescriptionExamples

db.system

string

experimental
Display name: Database system
An identifier for the database management system (DBMS) product being used. See below for a list of well-known identifiers. 1

mongodb; mysql

deployment.environment

string

resource deprecatedUse deployment.environment.name instead.
Deprecated alias for deployment.environment.name. The deployment environment, for example, production, staging, or development. Will be removed in release 1.3.0. 2

PROD

deployment.environment.name

string

resource stable
The deployment environment name (OTel semconv canonical field), for example, production, staging, or development. Emitted alongside deployment.environment during the deprecation window. 3

PROD

deployment.environment.tag

string

resource stable
Optional tag for the deployment environment in multitenancy mode 4

SA080

dsoa.run.context

string

resource stable
The name of the Dynatrace Snowflake Observability Agent context (part of plugin) used to produce the telemetry (logs, traces, metrics, or events). In case of multiple contexts within the same plugin, this helps differentiate between them. If plugin delivers only one context, this field will have the same value as the plugin name. 5

users_all_roles

dsoa.run.id

string

resource stable
Unique ID of each execution of the Dynatrace Snowflake Observability Agent plugin. It can be used to differentiate between telemetry produced between two executions, for example, to calculate the change in the system. 6

4aa7c76c-e98c-4b8b-a5b3-a8a721bbde2d

dsoa.run.plugin

string

resource stable
The name of the Dynatrace Snowflake Observability Agent plugin that produced this telemetry. Use to filter all telemetry from a specific plugin (for example, 'query_history', 'warehouse_usage'). Distinct from dsoa.run.context, which may represent a sub-context within a plugin. 7

users

host.name

string

resource experimental
Display name: Host name
The host name as determined on the data source (for instance, OneAgent, extensions or OpenTelemetry).
Important: This is not the name of the host entity, which can be modified based on naming rules. 8
Tags: permission

ip-10-178-54-32.ec2.internal

service.name

string

resource stable
Display name: OTel service name
The logical name of the service. 9

shoppingcart

telemetry.exporter.name

string

resource experimental
Display name: Telemetry exporter name
The exporter name. 10

odin

telemetry.exporter.version

string

resource experimental
Display name: Telemetry exporter version
The full agent/exporter version. 11

1.285.1.20240101-256988

1

Always 'snowflake' for all Dynatrace Snowflake Observability Agent telemetry.

2

User-configured deployment environment label, for example, 'PROD', 'STG', or 'DEV'. Set via 'core.snowflake.deployment_environment'.

3

User-configured deployment environment label (OTel-stable canonical key), for example, 'PROD', 'STG', or 'DEV'. Set via 'core.snowflake.deployment_environment'. Prefer this key over the deprecated deployment.environment alias.

4

Optional user-defined tag for grouping Snowflake accounts in multitenancy mode, set via 'core.tag'.

5

Identifies the specific sub-context within the plugin (for example, 'query_history', 'users_all_roles').

6

Unique identifier for a single Dynatrace Snowflake Observability Agent execution run. Changes on every invocation.

7

The Dynatrace Snowflake Observability Agent plugin that produced this telemetry (for example, 'query_history', 'warehouse_usage').

8

The Snowflake account hostname (for example, 'xy12345.snowflakecomputing.com'), from 'core.snowflake.host_name'.

9

Always the Snowflake account identifier without '.snowflakecomputing.com' suffix (for example, 'myorg-myaccount').

10

Always 'dynatrace.snowagent' — identifies Dynatrace Snowflake Observability Agent as the telemetry exporter.

11

The installed Dynatrace Snowflake Observability Agent version in <major>.<minor>.<patch>.<build> format.

db.system has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

ValueDescriptionDisplay name

adabas

Adabas (Adaptable Database System)

Adabas

amazon-documentdb

Amazon DocumentDB

DocumentDB

aurora-mysql

Amazon Aurora MySQL

Aurora MySQL

aurora-postgresql

Amazon Aurora PostgreSQL

Aurora PostgreSQL

cache

InterSystems Caché

InterSystems Caché

cassandra

Apache Cassandra

Cassandra

clickhouse

ClickHouse

ClickHouse

cloudscape

Cloudscape

Cloudscape

cockroachdb

CockroachDB

CockroachDB

coldfusion

ColdFusion IMQ

ColdFusion IMQ

cosmosdb

Microsoft Azure Cosmos DB

Cosmos DB

couchbase

Couchbase

Couchbase

couchdb

CouchDB

CouchDB

databricks

Databricks Data Platform

Databricks Data Platform

db2

IBM Db2

IBM Db2

derby

Apache Derby

Derby

dl/i

IBM DL/I

IBM DL/I

dynamodb

Amazon DynamoDB

DynamoDB

edb

EnterpriseDB

EnterpriseDB

elasticsearch

Elasticsearch

Elasticsearch

filemaker

FileMaker

FileMaker

firebird

Firebird

Firebird

firstsql

FirstSQL

FirstSQL

geode

Apache Geode

Geode

h2

H2

H2

hanadb

SAP HANA

SAP HANA

hbase

Apache HBase

HBase

hive

Apache Hive

Hive

hsqldb

HyperSQL DataBase

HSQLDB

informix

Informix

Informix

ingres

Ingres

Ingres

instantdb

InstantDB

InstantDB

interbase

InterBase

InterBase

keyspaces-cassandra

Amazon Keyspaces for Apache Cassandra

Keyspaces

mariadb

MariaDB

MariaDB

maxdb

SAP MaxDB

SAP MaxDB

memcached

Memcached

Memcached

mongodb

MongoDB

MongoDB

mssql

Microsoft SQL Server

SQL Server

mssqlcompact

Microsoft SQL Server Compact

SQL Server Compact

mysql

MySQL

MySQL

neo4j

Neo4j

Neo4j

neptune

Amazon Neptune

Neptune

netezza

Netezza

Netezza

opensearch

OpenSearch

OpenSearch

oracle

Oracle Database

Oracle

other_sql

Some other SQL database. Fallback only. See notes.

Other SQL

pervasive

Pervasive PSQL

Pervasive PSQL

phoenix

Apache Phoenix

Apache Phoenix

pointbase

PointBase

PointBase

postgresql

PostgreSQL

PostgreSQL

progress

Progress Database

Progress

redis

Redis

Redis

redshift

Amazon Redshift

Redshift

snowflake

Snowflake Data Platform

Snowflake Data Platform

spanner

Cloud Spanner

Cloud Spanner

sqlite

SQLite

SQLite

sybase

Sybase

Sybase

teradata

Teradata

Teradata

valkey

Valkey

Valkey

vertica

Vertica

Vertica

Query history span fields

Attribute fields for query history spans.

AttributeTypeDescriptionExamples

db.snowflake.tables

string[]

stable
The tables involved in the query.

['users', 'orders']

db.snowflake.views

string[]

stable
The views involved in the query. 1

['user_view']

dsoa.debug.span.events.added

long

stable
Internal debug field indicating the number of span events successfully added to the given span.

5

dsoa.debug.span.events.failed

long

stable
Internal debug field indicating the number of span events that failed to be added to the given span.

1

dsoa.plugins.query_history.obfuscation_mode

string

experimental
Configuration key controlling query text obfuscation mode applied to db.query.text and snowflake.error.message. 2

none

dsoa.plugins.query_history.track_ddl_changes

boolean

experimental
EXPERIMENTAL. When true, the plugin surfaces DDL change attribution attributes (snowflake.object.type, .id, .name, snowflake.object.ddl.operation, snowflake.object.ddl.properties) on query_history events whose ACCESS_HISTORY row carries an OBJECT_MODIFIED_BY_DDL payload. Covers database-object DDL only (tables, views, schemas, procedures). Warehouse and resource-monitor DDL does not populate OBJECT_MODIFIED_BY_DDL and is not affected by this setting — use db.operation.name for warehouse change detection. Default false preserves backward-compatible behavior. May be refactored into a dedicated plugin in a future release. 3

false

snowflake.cluster_number

long

experimental
The warehouse cluster number associated with the query.

1

snowflake.cost_attribution.period_end

long

experimental
End of the cost attribution summary window.

1730844667000000000

snowflake.cost_attribution.period_start

long

experimental
Start of the cost attribution summary window.

1730841067000000000

snowflake.database.id

long

stable
The unique identifier of the database involved in the query. 4

123456

snowflake.object.ddl.operation

string

stable
The SQL keyword that specifies the operation on the table, view, or column.

REPLACE

snowflake.object.type

string

stable
The domain of the object defined or modified by the DDL operation.

Table

snowflake.query.accel_est.estimated_query_times

string

stable
Object that contains the estimated query execution time in seconds for different query acceleration scale factors. If the status for the query is not eligible for query acceleration, this object is empty. 5

{ "scaleFactor1": 10, "scaleFactor2": 5 }

snowflake.query.accel_est.status

string

stable
Indicates whether the query is eligible to benefit from the query acceleration service.

eligible

snowflake.query.accel_est.upper_limit_scale_factor

long

stable
Number of the highest query acceleration scale factor in the estimatedQueryTimes object. If the status for the query is not eligible for query acceleration, this field is set to 0.

2

snowflake.query.data_transfer.inbound.cloud

string

stable
The cloud provider from which data was transferred inbound.

AWS

snowflake.query.data_transfer.inbound.region

string

stable
The region from which data was transferred inbound.

us-west-2

snowflake.query.data_transfer.outbound.cloud

string

stable
The cloud provider to which data was transferred outbound.

AWS

snowflake.query.data_transfer.outbound.region

string

stable
The region to which data was transferred outbound.

us-west-2

snowflake.query.is_client_generated

boolean

stable
Indicates if the statement was generated by the client.

true

snowflake.query.retry_cause

string

stable
The cause for retrying the query, if applicable.

Network issue

snowflake.query.step.id

long

experimental
Identifier of the step in the query execution plan. operator_id values are unique within a step, not across the full query.

1

snowflake.query.step.operator.attributes

string

experimental
Information about the operator, depending on the operator type. 6

{ "equality_join_condition": "(T4.C = T1.C)", "join_type": "INNER" }

snowflake.query.step.operator.id

long

experimental
The operator's identifier, unique within a step. Values start at 0.

0

snowflake.query.step.operator.parent_ids

string[]

experimental
Identifiers of the parent operators for this operator, or NULL if this is the final operator in the query plan. 7

['0', '1']

snowflake.query.step.operator.stats

string

experimental
Statistics about the operator (for example, the number of output rows from the operator). 8

{ "input_rows": 64, "output_rows": 64 }

snowflake.query.step.operator.time_breakdown

string

experimental
The breakdown of the execution time of the operator:

- overall_percentage: The percentage of the total query time spent by this operator,
- initialization: Time spent setting up query processing,
- processing: Time spent processing the data by the CPU,
- synchronization: Time spent synchronizing activities between participating processes,
- local_disk_io: Time during which processing was blocked while waiting for local disk access,
- remote_disk_io: Time during which processing was blocked while waiting for remote disk access,
- network_communication: Time during which processing was waiting for network data transfer. 9

{ "overall_percentage": 50.0,"initialization": 0.5,"processing": 4.0,"synchronization": 0.5,"local_disk_io": 0.2,"remote_disk_io": 0.1,"network_communication": 0.2 }

snowflake.query.step.operator.type

string

experimental
The type of query operator (for example, TableScan or Filter).

TableScan

snowflake.query.transaction_id

long

stable
The transaction ID associated with the query.

7890123456

snowflake.query.with_operator_stats

boolean

experimental
Indicates if the query was executed with operator-level statistics enabled.

true

snowflake.release_version

string

experimental
The release version of Snowflake at the time of query execution.

5.0

snowflake.role.type

string

stable
The type of role used to execute the query.

PRIMARY

snowflake.schema.id

long

experimental
The unique identifier of the schema involved in the query.

78901

snowflake.secondary_role_stats

string

experimental
Statistics related to secondary roles used during the query execution.

role_stat1

snowflake.warehouse.cluster.number

long

stable
The cluster number of the warehouse used.

1

snowflake.warehouse.id

long

experimental
The unique identifier of the warehouse used.

12345

snowflake.warehouse.size

string

stable
The size of the warehouse used.

X-SMALL

snowflake.warehouse.type

string

stable
The type of warehouse used.

STANDARD

1

Fully proprietary; no OTel analog.

2

Note: this is the SD-catalog attribute name; the actual config path read at runtime is plugins.query_history.obfuscation_mode (no dsoa. prefix) — see 050_f_get_query_history.sql.

3

Note: this is the SD-catalog attribute name; the actual config path is plugins.query_history.track_ddl_changes (no dsoa. prefix). Not currently wired up to any reader in code — setting this has no runtime effect yet.

4

ACCOUNT_USAGE.DATABASES supplies related fields (name, owner, owner_role_type, type, is_transient, lifecycle, retention_time, comment) but these should be populated by a future inventory plugin, not query_history (≈180-min latency + cost). In query_history, snowflake.database.id stays a foreign key only.

5

Serialized JSON object stored as string in Grail. Contains estimated query execution times per scale factor. Parse with parseJson() in DQL.

6

Serialized JSON object stored as string in Grail. Contains query operator specific attributes (for example, join conditions). Parse with parseJson() in DQL.

7

Array of parent operator IDs stored as string[] in Grail. Values are numeric strings.

8

Serialized JSON object stored as string in Grail. Contains query operator execution statistics (for example, input_rows, output_rows). Parse with parseJson() in DQL.

9

Serialized JSON object stored as string in Grail. Contains query operator time breakdown (for example, overall_percentage). Parse with parseJson() in DQL.