At a glance
An alert that fires when this week’s Snowflake credit consumption is at least 50% higher than the prior week, without a matching rise in query volume. This is the Snowflake-distinctive cost-surprise detector: a runaway query, a misconfigured warehouse, or a scheduled job that overran is the number one source of unexpected Snowflake bills. The whole point of the “without proportional query growth” clause is to separate “we are simply doing more work” (fine, expected) from “we are paying a lot more for the same work” (a problem worth a page).
Calculation
Two seven-day windows are compared. The current window is the trailing 7 days; the comparison window is the 7 days immediately before it. For each window the engine sums credits fromMETERING_HISTORY (the authoritative billing source: it records credits per warehouse per hour, including compute, cloud-services, and serverless lines) and counts completed statements from QUERY_HISTORY.
The alert evaluates two ratios:
METERING_HISTORY carries a latency of up to roughly 3 hours, the card evaluates on completed hourly buckets, so the most recent partial hour is excluded to avoid a false “drop”.
Worked example
A platform team runs a Snowflake account that powers ecommerce analytics: dbt models overnight, BI dashboards through the day, and a reverse-ETL job pushing segments back to the marketing stack. Snapshot taken on 12 Mar 26.
Credits jumped 61% while query volume barely moved. The alert fires. The dashboard surfaces the per-warehouse split so the on-call engineer does not have to go hunting:
TRANSFORM_WH was resized to XL during a one-off backfill three weeks ago and never resized back. With auto-suspend at 600 seconds it stays warm between dbt batches, and at XL each warm minute costs four times what it did at L. Query count is flat because the same models run; the credits are flat-out wasted on oversized, under-utilised compute.
What the team does, in order:
- Confirm it is not legitimate growth. Query count is flat and avg cost per query is up 55%, so this is inefficiency, not scale. Confirmed.
- Right-size the offender. Resize
TRANSFORM_WHback to L and shorten auto-suspend to 60 seconds for a batch workload that does not benefit from staying warm. Estimated saving: roughly 580 credits/week. - Quarantine the noisy job.
REVERSE_ETL_WHre-ran four times on transient errors. That is a reliability issue, not a sizing one; route it to the Query Error Rate Spike owner. - Set a budget guardrail. Add a resource monitor on the account so a future overrun trips a suspend before it costs a full week of credits.
Sibling cards
Reconciling against the source
Where to look in Snowflake:A representative reconciliation query:SNOWFLAKE.ACCOUNT_USAGE.METERING_HISTORYis the authoritative credit ledger. SumCREDITS_USEDgrouped bySTART_TIMEtruncated to the day or week to reproduce the comparison.SNOWFLAKE.ACCOUNT_USAGE.WAREHOUSE_METERING_HISTORYfor the per-warehouse breakdown that drives the credit-delta table.SNOWFLAKE.ACCOUNT_USAGE.QUERY_HISTORYfor the query-count side of the ratio. Snowsight, Admin to Cost Management for the managed-service console view of credits, broken down by warehouse, service type, and day.
Cross-connector reconciliation:
Known limitations / FAQs
The alert fired but our spend genuinely went up because we onboarded a new team. Is it a false positive? Partly. The guard clause checks credit growth against query growth, so onboarding that lifts both should stay quiet. It can still fire if the new team’s queries are far more expensive per statement than your existing baseline (large scans, heavy joins, low warehouse utilisation). In that case the alert is correctly flagging that the new workload is inefficient, even though the headcount growth is legitimate. Use Avg Cost per Query to confirm. Why measure week-over-week instead of day-over-day? Snowflake workloads are strongly weekly: weekday dbt and BI load, quieter weekends, month-end reporting spikes. A day-over-day comparison would fire every Monday. The 7-day window smooths the weekly cycle so the alert reflects a real shift in the cost-per-work ratio rather than the normal weekday rhythm. METERING_HISTORY lags by a few hours. Can the alert be late? Yes, by up to roughly 3 hours. The card evaluates on completed hourly credit buckets, so a runaway that started in the last hour will show up once that hour’s metering record lands. For sub-hour cost runaways, lean on Warehouse Saturation % and Active Warehouses, which read live state. Does this include storage cost growth, or only compute credits? Only credits fromMETERING_HISTORY, which is compute, cloud-services, and serverless. Storage is billed separately in terabytes, not credits, and is tracked by Storage Used (TB). A storage spike will not trip this card.
What counts as “proportional” query growth?
The engine treats credit growth as anomalous when it materially exceeds query growth, not when the two are penny-perfect. A 50% credit rise on 45% query growth is proportional and stays quiet; a 50% credit rise on 4% query growth fires. The exact tolerance is tuned per profile in the Alert Rules tab so you can match your own baseline volatility.
A scheduled job re-ran several times and tripled its warehouse’s credits. Will that fire this card?
Often yes, and that is intended. Re-runs add queries, but transient-failure retries on a warm oversized warehouse can lift credits far more than the extra query count, producing exactly the credit-over-query divergence this card detects. Treat it as a joint cost-and-reliability issue and cross-check Query Error Rate Spike.