Found something strange in your Snowflake bill?

What to send

Least sensitive first. Any one of these is enough — the first is the one I would rather have, because its output is aggregates rather than anybody's query text.

1. Best — the tool's output

   warehouse-teardown is a read-only, open-source, one-file CLI. It reads Snowflake's own metadata and prints credits per warehouse, the median gap between queries, the most expensive queries and the tables nothing reads.

   # fake data, no credentials
   pipx run --spec git+https://github.com/hikmahtech/warehouse-teardown warehouse-teardown --demo
   
   # your account, read-only
   pipx run --spec git+https://github.com/hikmahtech/warehouse-teardown warehouse-teardown --days 30 --json > teardown.json

   Run the first one and you see exactly what the output looks like before it touches your account. It only reads; it changes nothing. The --spec is there because the tool installs straight from its repository.

2. Or — a cost export out of Snowflake

   In Snowsight the cost screens are under Admin » Cost management » Consumption, with a usage-type filter for Compute, Storage and Data Transfer. If that screen gives you a download, send it. If not, the SQL below gives the same numbers and is what I would rather have anyway. Cost data can take up to 72 hours to appear in Snowsight.

   Two queries against SNOWFLAKE.ACCOUNT_USAGE — what each warehouse cost, and whether each one ever actually went to sleep. Both are read-only. You need a role that can read the SNOWFLAKE database. On most accounts that is ACCOUNTADMIN; to hand it to someone else, grant imported privileges on database snowflake to role <theirs>.

   -- what each warehouse cost, and how much of that was idling.
   -- This is Snowflake's own idle-cost query, off its metering-history docs.
   select warehouse_name,
          sum(credits_used_compute)                   as compute_credits,
          sum(credits_attributed_compute_queries)     as query_credits,
          sum(credits_used_compute)
            - sum(credits_attributed_compute_queries) as idle_credits
   from snowflake.account_usage.warehouse_metering_history
   where start_time >= dateadd(day, -30, current_date())
     and end_time   <  current_date()
   group by 1
   order by idle_credits desc;
   
   -- and whether each warehouse ever actually went to sleep, last 14 days
   select warehouse_name, count(*) as autosuspends
   from snowflake.account_usage.warehouse_events_history
   where timestamp >= dateadd(day, -14, current_timestamp())
     and event_name = 'SUSPEND_WAREHOUSE'
     and event_reason = 'WAREHOUSE_AUTOSUSPEND'
   group by 1
   order by autosuspends;

   A warehouse whose idle_credits are most of its compute_credits over 30 days, and which appears nowhere in the second result, has not slept in a fortnight. That finding has its own page, with the arithmetic and a longer query.

3. Or — a screenshot

   If the above is more than you want to do right now, a screenshot of the usage or billing screen is enough to start. I would rather answer a screenshot than have you send nothing.

4. Not on Snowflake?

   BigQuery, Databricks, Redshift: send whatever your billing console exports. The questions are the same — what share is compute, what is running when nobody is asking it anything, and what is being rebuilt that nothing reads.