All about SnowLens - Snowflake observability and anomaly detection tool

SnowLens

Free Snowflake Observability -- 9 Detectors, Zero Data Egress

100% Free Runs Inside Snowflake 9 Detection Rules No Outbound Calls

If you are running Snowflake in production, you have probably asked yourself: Which queries are burning credits? Why did costs spike last Tuesday? Are any warehouses just sitting there idle?

Most observability tools answer these questions by shipping your query logs to an external SaaS -- which means data egress, vendor lock-in, and yet another subscription. SnowLens takes a fundamentally different approach: it is a Streamlit app that installs directly into your Snowflake account and runs on your own compute. Your data never leaves your environment.

And it is completely free -- no payment, no signup, no feature gating, no expiry.

In This Post

1. How SnowLens Works
2. The 9 Detection Rules (with Logic)
3. Privacy and Security Model
4. Memory Safety for Large Accounts
5. How to Install (5 Minutes)
6. Download and Source Code

How SnowLens Works

SnowLens reads from three Snowflake metadata views that every account already has:

• SNOWFLAKE.ACCOUNT_USAGE.QUERY_HISTORY -- every query that ran, with timing, status, bytes scanned, spill metrics, and queue time
• SNOWFLAKE.ACCOUNT_USAGE.WAREHOUSE_METERING_HISTORY -- hourly credit consumption per warehouse
• SNOWFLAKE.ACCOUNT_USAGE.QUERY_ATTRIBUTION_HISTORY -- credit attribution per query for cost-by-workload analysis

These are Snowflake's own internal metadata views -- not your business data. SnowLens never touches your tables, stages, or query results. It runs 9 detection rules against this metadata, flags anomalies, and gives you plain-English recommendations for each finding.

S

Zero Data Egress

Everything stays inside your Snowflake account. No external API calls.

N

No Infrastructure

Runs on Streamlit-in-Snowflake -- built into every account.

F

Completely Free

All 9 detectors. No payment, no expiry, no feature gating.

U

Clean Uninstall

One SQL script removes everything. No residue.

The 9 Detection Rules

SnowLens ships with 5 performance detectors and 4 cost detectors, plus a cost attribution engine. Here is exactly what each one does and the logic behind it.

Performance Detectors

1 Slow Query Finder Performance

Flags queries that exceed a configurable elapsed-time threshold. You pick the threshold: 10s, 20s, 30s, or 60s. An optional SELECT-only toggle filters out ETL/DML workloads so you only see slow analytical queries -- the ones your users are actually waiting on.

WHERE TOTAL_ELAPSED_TIME > :SLOW_S * 1000
AND (NOT :SELECT_ONLY OR QUERY_TYPE = 'SELECT')
QUALIFY ROW_NUMBER() OVER (ORDER BY TOTAL_ELAPSED_TIME DESC) <= 200

2 Cancelled Query Detector Performance

Catches queries that were manually stopped or killed by a timeout -- often a sign of runaway workloads, bad joins, or misconfigured statement timeouts.

WHERE EXECUTION_STATUS = 'FAIL'
AND ERROR_MESSAGE ILIKE '%cancel%'

3 Query Failure Detector Performance

Surfaces non-cancellation failures -- syntax errors, permission issues, resource limits, and other runtime errors that might be going unnoticed.

WHERE EXECUTION_STATUS = 'FAIL'
AND (ERROR_MESSAGE IS NULL OR ERROR_MESSAGE NOT ILIKE '%cancel%')

4 Disk Spill Detector Performance

Finds queries that exhausted their warehouse memory and spilled data to disk. SnowLens classifies spills as local (SSD -- recoverable) or remote (S3/blob -- high risk, major performance impact) and flags remote spills with a prominent warning.

WHERE BYTES_SPILLED_TO_LOCAL_STORAGE > 0
OR BYTES_SPILLED_TO_REMOTE_STORAGE > 0
-- baseline_value carries remote bytes for classification

5 Queuing / Contention Detector Performance

Detects warehouses where queries are queuing because too many run concurrently. If cumulative QUEUED_OVERLOAD_TIME exceeds 60 seconds for a warehouse, it is flagged -- with a recommendation to enable multi-cluster warehouses.

SELECT WAREHOUSE_NAME,
SUM(QUEUED_OVERLOAD_TIME) AS total_overload_ms,
COUNT_IF(QUEUED_OVERLOAD_TIME > 0) AS queued_count
...
WHERE total_overload_ms > 60000

Cost Detectors

6 Credit Spike Detector Cost

Compares each warehouse's hourly credit consumption to its own rolling baseline. Flags any hour where usage spikes more than 2 standard deviations above average -- catching runaway queries, forgotten warehouses, or unexpected batch jobs before they balloon your bill.

-- Per-warehouse baseline: AVG + STDDEV over the cost window
WHERE credits > avg_credits + (2 * stddev_credits)

7 Idle-But-Running Detector Cost

Catches warehouses that burned credits in an hour but ran zero queries. This usually means auto-suspend is set too high, or the warehouse was left on after a manual resume.

WHERE credits > 0.01 AND COALESCE(query_count, 0) = 0

8 Oversized Warehouse Detector Cost

Identifies warehouses sized larger than their workload needs by comparing average bytes scanned against the warehouse size tier. A MEDIUM warehouse scanning tiny amounts of data per query is wasting money.

WHERE WAREHOUSE_SIZE NOT IN ('X-Small', 'Small')
AND avg_bytes_scanned < 100000000 -- less than 100 MB avg

9 Workload Cost Spike Detector Cost

Groups credit usage by QUERY_TAG (or role as fallback) and flags workloads that are statistical outliers. Uses Snowflake's QUERY_ATTRIBUTION_HISTORY for accurate per-query credit attribution.

-- Cross-workload baseline
WHERE total_credits > avg_credits + (2 * stddev_credits)

Bonus: Cost Attribution by Workload

Beyond the 9 detection rules, SnowLens includes a cost attribution engine that groups credit usage by the most specific signal available: an explicit QUERY_TAG, a detected dbt model name, or the executing role as a fallback. This gives you a clear breakdown of who is spending what -- regardless of your orchestration tool (Airflow, Matillion, dbt, cron, etc.).

Privacy and Security Model

This is the part that makes SnowLens fundamentally different from tools like Unravel, SELECT, or Keebo:

Your Snowflake Account

SnowLens lives here

←

ACCOUNT_USAGE

Snowflake's own schema

×

External / Internet

never reached

• Only reads Snowflake metadata -- QUERY_HISTORY and WAREHOUSE_METERING_HISTORY, not your business tables
• No outbound network calls -- Streamlit-in-Snowflake runs in an isolated environment
• Runs on your compute -- an XSMALL warehouse, auto-suspend 60s, a few cents per session
• Least-privilege role -- a dedicated SNOWLENS_FULL_ROLE with only the permissions the app needs

Memory Safety for Large Accounts

Streamlit-in-Snowflake has a ~32 MB memory limit. For accounts with thousands of daily queries and wide detection windows (30-90 days), naive queries would crash the app. SnowLens includes four hardening measures:

1. Query text truncation -- stored snippets are capped at 300 characters
2. Per-detector row caps -- each detector returns only its top 200 findings by severity (QUALIFY ROW_NUMBER())
3. SQL-side aggregation -- cost attribution is aggregated in SQL before loading into Python
4. Warehouse scope selector -- limit detection to individual warehouses to reduce result volume

These measures keep the app responsive even on large enterprise accounts with 90-day detection windows.

How to Install (5 Minutes)

Three steps, all inside Snowsight. No CLI, no cloud console, no infrastructure.

1. Download the ZIP from snowlens.vizcanvaz.com -- two SQL scripts and two Python files
2. Run sql/01_setup.sql as ACCOUNTADMIN in a Snowsight worksheet -- creates the database, warehouse, stage, and role
3. Upload streamlit_app.py and environment.yml to the stage, then run sql/02_create_app.sql

Done. Open Projects > Streamlit > SNOWLENS_APP in Snowsight and all 9 detectors are ready. To uninstall, run sql/99_uninstall.sql -- drops everything in 3 lines.

Download and Source Code

Try SnowLens -- It's Free

9 detectors. Zero data egress. Install in 5 minutes.

Product Page GitHub Repository

Built by VizCanvaz | Questions? Email vizcanvas@gmail.com