Creates a new alert in the current schema.

This command also supports the following variant:

  • CREATE ALERT … CLONE (creates a clone of an existing alert)

See also:



Newly created or cloned alerts are suspended upon creation. For information on resuming suspended alerts, see Suspending and resuming an alert.


  [ WAREHOUSE = <warehouse_name> ]
  SCHEDULE = '{ <num> MINUTE | USING CRON <expr> <time_zone> }'
  COMMENT = '<string_literal>'
  [ [ WITH ] TAG ( <tag_name> = '<tag_value>' [ , <tag_name> = '<tag_value>' , ... ] ) ]

Variant syntax


Creates a new alert with the same parameter values:

CREATE [ OR REPLACE ] ALERT <name> CLONE <source_alert>
  [ ... ]

For more details, see CREATE <object> … CLONE.


When you clone an alert by using CREATE ALERT <name> CLONE or by cloning a schema or database containing the alert, the new alert has all of the properties of the original alert except for any properties that you explicitly override.

Required parameters


String that specifies the identifier (i.e. name) for the alert; must be unique for the schema in which the alert is created.

In addition, the identifier must start with an alphabetic character and cannot contain spaces or special characters unless the entire identifier string is enclosed in double quotes (e.g. "My object"). Identifiers enclosed in double quotes are also case-sensitive.

For more details, see Identifier requirements.


Specifies the schedule for periodically evaluating the condition for the alert.

You can specify the schedule in one of the following ways:

  • USING CRON expr time_zone

    Specifies a cron expression and time zone for periodically evaluating the condition for the alert. Supports a subset of standard cron utility syntax.

    The cron expression consists of the following fields:

    # __________ minute (0-59)
    # | ________ hour (0-23)
    # | | ______ day of month (1-31, or L)
    # | | | ____ month (1-12, JAN-DEC)
    # | | | | _ day of week (0-6, SUN-SAT, or L)
    # | | | | |
    # | | | | |
      * * * * *

    The following special characters are supported:

    Special Character



    Wildcard. When specified for a given field, the alert runs at every unit of time for that field.

    For example, * in the month field specifies that the alert runs every month.


    Stands for “last”. When used in the day-of-week field, it allows you to specify constructs such as “the last Friday” (“5L”) of a given month. In the day-of-month field, it specifies the last day of the month.


    Indicates the nth instance of a given unit of time. Each quanta of time is computed independently.

    For example, if 4/3 is specified in the month field, then the evaluation of the condition is scheduled for April, July and October (i.e. every 3 months, starting with the 4th month of the year).

    The same schedule is maintained in subsequent years. That is, the condition is not scheduled to be evaluated in January (3 months after the October run).


    • The cron expression currently evaluates against the specified time zone only. Altering the TIMEZONE parameter value for the account (or setting the value at the user or session level) does not change the time zone for the alert.

    • The cron expression defines all valid times for the evaluation of the condition for the alert. Snowflake attempts to evaluate the condition based on this schedule; however, any valid run time is skipped if a previous run has not completed before the next valid run time starts.

    • When both a specific day of month and day of week are included in the cron expression, then the evaluation of the condition is scheduled on days satisfying either the day of month or day of week. For example, SCHEDULE = 'USING CRON 0 0 10-20 * TUE,THU UTC' schedules an evaluation at 0AM on any 10th to 20th day of the month and also on any Tuesday or Thursday outside of those dates.

  • num MINUTE

    Specifies an interval (in minutes) of wait time inserted between evaluations of the alert. Accepts positive integers only.

    Also supports num M syntax.

    To avoid ambiguity, a base interval time is set when the alert is resumed (using ALTER ALERT … RESUME).

    The base interval time starts the interval counter from the current clock time. For example, if an alert is created with 10 MINUTE and the alert is resumed at 9:03 AM, then the condition for the alert is evaluated at 9:13 AM, 9:23 AM, and so on. Note that we make a best effort to ensure absolute precision, but only guarantee that conditions are not evaluated before their set interval occurs (e.g. in the current example, the condition could be evaluated first at 9:14 AM but definitely not at 9:12 AM).


    The maximum supported value is 11520 (8 days). Alerts that have a greater num MINUTE value never have their conditions evaluated.

COMMENT = 'string_literal'

Specifies a comment for the alert.

TAG ( tag_name = 'tag_value' [ , tag_name = 'tag_value' , ... ] )

Specifies the tag name and the tag string value.

The tag value is always a string, and the maximum number of characters for the tag value is 256.

For information about specifying tags in a statement, see Tag quotas for objects and columns.

IF( EXISTS( condition ))

The SQL statement that represents the condition for the alert. You can use the following commands:

If the statement returns one or more rows, the action for the alert is executed.

THEN action

The SQL statement that should be executed if the condition returns one or more rows.

To send a notification, you can call the SYSTEM$SEND_EMAIL or SYSTEM$SEND_SNOWFLAKE_NOTIFICATION stored procedure.

Optional parameters

WAREHOUSE = warehouse_name

Specifies the virtual warehouse that provides compute resources for executing this alert.

For serverless alerts, do not set this property.

Access control requirements

A role used to execute this SQL command must have the following privileges at a minimum:






Required only for serverless alerts.







Required only for alerts that specify a warehouse to use.

Note that operating on any object in a schema also requires the USAGE privilege on the parent database and schema.

For instructions on creating a custom role with a specified set of privileges, see Creating custom roles.

For general information about roles and privilege grants for performing SQL actions on securable objects, see Overview of Access Control.

Usage notes

  • Alerts are executed using the privileges granted to the alert owner (i.e. the role that has the OWNERSHIP privilege on the alert). For the list of minimum required privileges to execute alerts, see Granting the privileges to create alerts.

    To verify that the alert owner role has the required privileges to execute SQL statements for the condition and action, we recommend that you execute these statements using the alert owner role before specifying them in CREATE ALERT.

  • When you create an alert, the alert is suspended by default.

    To make the alert active, you must execute ALTER ALERT … RESUME.

  • When you execute CREATE ALERT or ALTER ALERT, some validation checks are not performed on the statements in the condition and action, including:

    • The resolution of the identifiers for objects.

    • The resolution of the data types of expressions.

    • The verification of the number and types of arguments in a function call.

    The CREATE ALERT and ALTER ALERT commands do not fail if the SQL statement for a condition or action specifies an invalid identifier, incorrect data type, incorrect number and types of function arguments, etc. Instead, the failure occurs when the alert executes.

    To check for failures in an existing alert, use the ALERT_HISTORY table function.

    To avoid these types of failures, before you specify the conditions and actions for alerts, verify the SQL expressions and statements for those conditions and actions.

  • Regarding metadata:


    Customers should ensure that no personal data (other than for a User object), sensitive data, export-controlled data, or other regulated data is entered as metadata when using the Snowflake service. For more information, see Metadata Fields in Snowflake.

  • CREATE OR REPLACE <object> statements are atomic. That is, when an object is replaced, the old object is deleted and the new object is created in a single transaction.


See Creating an alert.