Streamlit-in-Snowflake · 2 Apps · 9 Detectors · 100% Free

Snowflake observability that never leaves your account

SnowLens installs directly into your Snowflake account as two free apps: an anomaly dashboard with 9 detectors, and a warehouse sizing advisor that recommends the right size and cluster count from your own usage history — nothing is ever sent outside your environment.

No SaaS. No outbound calls. Runs inside Snowflake on your compute.
🔒

Zero data egress

SnowLens reads only Snowflake's own metadata views. Your data never leaves your account, ever.

No infrastructure to manage

Runs on Streamlit-in-Snowflake, which is built into every Snowflake account. Nothing to deploy.

🎁

Completely free

Both apps, all 9 detectors, sizing recommendations, cost attribution — no payment, no signup, no expiry.

🗑️

Uninstall in one command

One SQL script removes every object SnowLens created. No residue, no lock-in.

Two apps, one install

SnowLens installs as two Streamlit apps sharing one stage, one warehouse, and one least-privilege role. They answer different questions.

App 1

🔍 Anomaly Dashboard

What went wrong? 9 detectors covering slow queries, failures, disk spill, queuing, credit spikes, idle warehouses, and workload cost outliers — each with a plain-English recommendation.

SNOWLENS_APP 9 detectors
App 2 · New

📐 Warehouse Sizing Advisor

Is each warehouse the right size? Analyses spill, queuing, scan volume and concurrency per warehouse, then recommends a size and cluster count with ready-to-review ALTER WAREHOUSE statements.

SNOWLENS_SIZING_ADVISOR Data-driven

Performance and cost anomalies, caught automatically

SnowLens ships with 9 detection rules covering query performance and warehouse cost. Every flagged event comes with a plain-English recommendation and a specific next step.

Performance

🐢 Slow Query Finder

Flags queries that exceed a configurable threshold (10s / 20s / 30s / 60s). Optional SELECT-only filter to ignore ETL/DML workloads.

Configurable threshold SELECT-only toggle
Performance

🚫 Cancelled Query Detector

Catches queries manually stopped or cancelled by a timeout — often a sign of runaway workloads or misconfigured timeouts.

Error-pattern match Rolling window
Performance

⚠️ Query Failure Detector

Surfaces non-cancellation query failures — syntax errors, permission issues, resource limits, and other runtime errors.

Non-cancel failures Error detail
Performance

💿 Disk Spill Detector

Finds queries that ran out of memory and spilled to disk. Classifies local vs remote spill and flags remote spill as high risk.

Local vs remote High-risk banner
Performance

⏳ Queuing / Contention Detector

Detects warehouses where queries queue due to concurrency overload (>60s cumulative). Recommends multi-cluster warehouses.

Concurrency analysis Multi-cluster advice
Cost

💸 Credit Spike Detector

Compares each warehouse's hourly credit usage to its own rolling baseline. Flags hours where usage spikes more than 2 standard deviations above average.

Per-warehouse 2σ threshold
Cost

😴 Idle-But-Running Detector

Catches warehouses burning credits with zero queries running — forgotten warehouses, misconfigured auto-suspend, or orphaned resources.

Credits > 0, queries = 0 Waste identification
Cost

📏 Oversized Warehouse Detector

Identifies warehouses sized larger than their workload needs by comparing average bytes scanned against warehouse size tier.

Size vs workload Right-sizing advice
Cost

👤 Workload Cost Spike Detector

Finds workloads (by query tag or role) that are cost outliers compared to your other workloads — using credit attribution data.

Tag or role grouping Attribution-based
🏷️
Attribution

Cost Attribution by Workload

Groups credit usage by QUERY_TAG, detected dbt model, or role — giving you a clear breakdown of who's spending what. Works with any orchestration tool (Airflow, Matillion, dbt, cron).

Stop guessing warehouse sizes

Most teams size a warehouse once, then never revisit it. The Sizing Advisor reads your actual usage history and tells you which warehouses are undersized, oversized, or fighting for concurrency — with the reasoning behind every call.

💿 Remote spill rate

Share of queries spilling to remote storage. The strongest undersizing signal — remote spill is dramatically slower than memory or local SSD.

📊 p90 bytes scanned

The 90th-percentile scan per query, used instead of the mean so a handful of large queries can't mask an otherwise small workload.

⏳ Cumulative queue time

Signals concurrency pressure, which is fixed by scaling out to more clusters — not up to a bigger size. The advisor keeps these separate.

😴 Idle credit hours

Hours that burned credits with zero queries running, pointing directly at an AUTO_SUSPEND that's set too high.

1

Size up

Remote spill > 2% of queries, or local spill > 15%.

2

Size down

p90 scan < 100 MB, above Small, and spill under 1%.

3

Add clusters

Cumulative queue time > 60s — handled independently of size.

4

Keep

The evidence doesn't justify a change. No churn for its own sake.

Every recommendation carries a confidence level based on how many queries backed it, a plain-English explanation of why, and an estimated credits/hour delta. The app generates ALTER WAREHOUSE statements for you to review — it never executes them.

-- Generated for you to review, never executed -- ANALYTICS_WH: size up (high confidence) ALTER WAREHOUSE "ANALYTICS_WH" SET WAREHOUSE_SIZE = 'LARGE'; -- REPORTING_WH: add clusters (high confidence) ALTER WAREHOUSE "REPORTING_WH" SET MIN_CLUSTER_COUNT = 1, MAX_CLUSTER_COUNT = 3;

Your data stays where it belongs — in your account

Most observability tools require sending your query logs to an external SaaS. SnowLens is different by design.

🏢
Your Snowflake Account
SnowLens lives here
reads metadata
📊
ACCOUNT_USAGE
Snowflake's own schema
blocked
🌐
External / Internet
never reached

Only reads Snowflake metadata

Queries ACCOUNT_USAGE.QUERY_HISTORY and WAREHOUSE_METERING_HISTORY — Snowflake's own internal views, not your business tables.

No outbound network calls

Streamlit-in-Snowflake runs in an isolated environment. SnowLens makes no calls to external APIs or analytics services.

Runs on your compute

The app runs on a warehouse in your account. Typically a few cents per session on an XS warehouse.

Least-privilege role

The installer creates a dedicated role with only the permissions the app needs. It cannot access objects outside its own schema.

Up and running in under 5 minutes

Three steps. All done inside Snowsight. No CLI, no cloud console, no infrastructure.

1

Download the package

Download the ZIP from the button below. It contains three SQL scripts and three source files covering both apps. No other dependencies.

↓  Download SnowLens
Requires a Snowflake account (any edition — Standard works fine). No paid tier needed.
2

Run the setup script in Snowsight

Open a new Snowsight worksheet as ACCOUNTADMIN. Paste and run sql/01_setup.sql. This provisions a dedicated warehouse, database, stage, and role — nothing touches your existing objects.

-- sql/01_setup.sql (excerpt) USE ROLE ACCOUNTADMIN; CREATE WAREHOUSE IF NOT EXISTS SNOWLENS_FULL_WH WITH WAREHOUSE_SIZE = 'XSMALL' AUTO_SUSPEND = 60 AUTO_RESUME = TRUE; CREATE DATABASE IF NOT EXISTS SNOWLENS_FULL; GRANT IMPORTED PRIVILEGES ON DATABASE SNOWFLAKE TO ROLE SNOWLENS_FULL_ROLE;
GRANT IMPORTED PRIVILEGES on the SNOWFLAKE database is what allows the app to read ACCOUNT_USAGE. It grants read-only access to Snowflake's own metadata — not your data.
3

Upload files and create both apps

In Snowsight, navigate to Data → Databases → SNOWLENS_FULL → APP → Stages → SNOWLENS_STAGE and upload all three files from the src/ folder: streamlit_app.py, sizing_advisor.py, and environment.yml. Then run sql/02_create_app.sql, which creates both apps.

-- sql/02_create_app.sql (excerpt) CREATE OR REPLACE STREAMLIT SNOWLENS_APP ROOT_LOCATION = '@SNOWLENS_FULL.APP.SNOWLENS_STAGE' MAIN_FILE = 'streamlit_app.py' QUERY_WAREHOUSE = SNOWLENS_FULL_WH; CREATE OR REPLACE STREAMLIT SNOWLENS_SIZING_ADVISOR ROOT_LOCATION = '@SNOWLENS_FULL.APP.SNOWLENS_STAGE' MAIN_FILE = 'sizing_advisor.py' QUERY_WAREHOUSE = SNOWLENS_FULL_WH;

Done. Open Projects → Streamlit in Snowsight, where you'll find SNOWLENS_APP (9 detectors) and SNOWLENS_SIZING_ADVISOR (sizing recommendations).

To remove SnowLens completely, run sql/99_uninstall.sql as ACCOUNTADMIN. It drops the database, warehouse, and role in seconds.

Common questions

Is SnowLens really free?
Yes — completely free. Both apps, all 9 detectors, the warehouse sizing advisor, configurable detection windows, cost attribution, warehouse scope filtering. No payment, no signup, no expiry, no feature gating.
How does the Sizing Advisor decide what to recommend?
It reads six signals per warehouse over a 7, 30, or 90-day window: remote spill rate, local spill rate, p90 bytes scanned, cumulative queue time, peak hourly concurrency, and idle credit hours. It recommends sizing up when remote spill exceeds 2% of queries or local spill exceeds 15%; sizing down when p90 scan is under 100 MB with negligible spill and the warehouse is above Small; and adding clusters when cumulative queue time exceeds 60 seconds. Queuing is handled separately from sizing because concurrency pressure is fixed by scaling out, not up. Every threshold is documented inside the app, and every recommendation shows its reasoning and a confidence level based on how many queries backed it.
Does the Sizing Advisor change my warehouses automatically?
No. It generates ALTER WAREHOUSE statements for you to read and run yourself. Nothing is executed on your behalf. Sizing is empirical — the advisor only sees what already happened, so change one warehouse at a time and re-measure.
Why does the advisor use p90 bytes scanned instead of the average?
The mean is easily skewed. A warehouse running mostly small queries plus a handful of very large ones will show a high average scan, hiding the fact that it's oversized for the workload it actually handles most of the time. The 90th percentile reflects what the warehouse routinely does, which is a better basis for a sizing decision.
What data does SnowLens actually read?
SnowLens reads exclusively from the SNOWFLAKE.ACCOUNT_USAGE schema — Snowflake's own internal metadata about query history and warehouse usage. It does not query any of your business tables, and it does not have visibility into the actual content of your queries beyond what Snowflake stores in ACCOUNT_USAGE (query text snippets, timing, credit consumption).
Does any of my data get sent to VizCanvaz or anywhere else?
No. SnowLens runs entirely inside your Snowflake account via Streamlit-in-Snowflake. There are no outbound network calls in the app's code. VizCanvaz receives nothing from your account — not telemetry, not analytics, not usage data.
Will SnowLens handle a large account with 90 days of history?
Yes. SnowLens includes memory-safety hardening for Streamlit-in-Snowflake's ~32 MB limit: query text is truncated to 300 characters, each detector is capped to the top 200 findings by severity, cost attribution is aggregated in SQL, and you can scope detection to individual warehouses. The Sizing Advisor aggregates everything inside Snowflake and returns one compact row per warehouse, so it stays light regardless of account size. These measures keep both apps responsive even on accounts with thousands of daily queries.
Why does ACCOUNT_USAGE have a data latency?
Snowflake's ACCOUNT_USAGE views are not real-time — QUERY_HISTORY has a latency of up to 45 minutes, and WAREHOUSE_METERING_HISTORY up to 3 hours. This is Snowflake's own architecture, not a SnowLens limitation.
How do I uninstall SnowLens completely?
Run sql/99_uninstall.sql as ACCOUNTADMIN. It drops the database, warehouse, and role in three lines. Every object SnowLens created is gone with no residue.

Install in 5 minutes. Free, forever.

Download the ZIP, run two SQL scripts in Snowsight, and both apps are live.
Your data stays inside your account — always.

↓  Download SnowLens — Free

Questions? Email vizcanvas@gmail.com