Schema:

ORGANIZATION_USAGE

For guidance on query performance when using organization-wide usage views, see Performance (Organization Usage).

ALERT_HISTORY view

Important

This view is only available in the organization account. For more information, see Premium views in the organization account.

Organization Usage performance

When you query a specific view in the SNOWFLAKE.ORGANIZATION_USAGE schema, follow the organization-wide guidance in Performance (Organization Usage): bound every scan on history views, list columns explicitly, and use the time filter column table plus worked SQL and anti-patterns there.

This Organization Usage view enables you to retrieve the history of alert usage. The view displays one row for each run of an alert in the history.

Columns

Organization-level columns

Column NameData TypeDescription
ORGANIZATION_NAMEVARCHARName of the organization.
ACCOUNT_LOCATORVARCHARSystem-generated identifier for the account.
ACCOUNT_NAMEVARCHARUser-defined identifier for the account.

Additional columns

Column NameData TypeDescription
NAMEVARCHARName of the alert.
DATABASE_NAMEVARCHARName of the database that contains the alert.
SCHEMA_NAMEVARCHARName of the schema that contains the alert.
ACTIONVARCHARThe text of the SQL statement that serves as the action for the alert.
ACTION_QUERY_IDVARCHARInternal/system-generated identifier for the SQL statement executed as the action of the alert.
CONDITIONVARCHARThe text of the SQL statement that serves as the condition for the alert.
CONDITION_QUERY_IDVARCHARInternal/system-generated identifier for the SQL statement executed as the condition of the alert.
ERROR_CODENUMBER

Error code, if the alert returned an error or failed to execute (e.g. if the current user did not have privileges to execute the alert).

ERROR_MESSAGEVARCHARError message, if the alert returned an error.
STATEVARCHAR

Status of the alert. This can be one of the following:

  • SCHEDULED: The alert will execute at the time specified by the SCHEDULED_TIME column. This status does not apply to alerts on new data.
  • EXECUTING: The condition or action of the alert is currently executing.
  • FAILED: The alert failed. Either the alert condition or alert action encountered an error that prevented it from being executed.
  • CANCELLED: The alert execution was cancelled (e.g. when the alert is suspended).
  • CONDITION_FALSE: The condition was evaluated successfully but returned no data. As a result, the action was not executed. This status does not apply to alerts on new data.
  • CONDITION_FAILED: The evaluation of the condition failed. For details on the failure, check the ERROR_CODE and ERROR_MESSAGE columns.
  • ACTION_FAILED: The condition was evaluated successfully, but the execution of the action failed. For details on the failure, check the ERROR_CODE and ERROR_MESSAGE columns.
  • TRIGGERED: The condition was evaluated successfully, and the action was executed successfully.
SCHEDULED_TIMETIMESTAMP_LTZ

Time when the scheduled alert is/was scheduled to start running.

Note that we make a best effort to ensure absolute precision, but only guarantee that alerts do not execute before the scheduled time.

COMPLETED_TIMETIMESTAMP_LTZTime when the alert completed, or NULL if SCHEDULED_TIME is in the future or if the alert is still running.
DATABASE_IDNUMBERInternal/system-generated identifier for the database containing the schema.
SCHEMA_IDNUMBERInternal/system-generated identifier for the schema.
SCHEDULED_FROMVARCHAR

Specifies what initiated the alert. The column contains one of the following values:

  • SCHEDULE: The alert was scheduled to run normally, as described in SCHEDULE clause of CREATE ALERT.
  • EXECUTE ALERT: The alert was scheduled to run using EXECUTE ALERT.
  • TRIGGER: The alert on new data was run because the underlying table or view contains new data.
RUNBOOKVARCHAR

URL or free-text reference to a runbook for this alert. Returns NULL if not set.

WAS_AUTO_SUSPENDEDBOOLEAN

Indicates whether the alert was automatically suspended after this execution due to exceeding the consecutive failure threshold set by the SUSPEND_ALERT_AFTER_NUM_FAILURES parameter.

CONFIGVARCHAR

JSON configuration string stored on the alert at the time of this execution. Returns NULL if not set.

Usage notes

  • Latency for the view may be up to 24 hours.
  • For increased performance, filter queries on the COMPLETED_TIME or SCHEDULED_TIME column.

Examples

Retrieve records for the 10 most recent completed alert runs:

SELECT account_name, name, condition, condition_query_id, action, action_query_id, state
  FROM snowflake.organization_usage.alert_history
  LIMIT 10;

Retrieve records for alert runs completed in the past hour:

SELECT account_name, name, condition, condition_query_id, action, action_query_id, state
FROM snowflake.organization_usage.alert_history
WHERE COMPLETED_TIME > DATEADD(hours, -1, CURRENT_TIMESTAMP());