ANOMALY_INSIGHTS!ADHOC_CALCULATE_ANOMALIES_FROM_CONFIG

Runs cost anomaly detection against a configuration without creating an anomaly monitor. Use this method to test a combination of tags and service types before you save the combination as a monitor.

Syntax

SNOWFLAKE.LOCAL.ANOMALY_INSIGHTS!ADHOC_CALCULATE_ANOMALIES_FROM_CONFIG(
  <config>,
  '<start_date>',
  '<end_date>' )

Arguments

config

Configuration that defines the scope to test. It uses the same keys as the configuration of a saved monitor, but it names each tag directly with the tagDatabase, tagSchema, tagName, and tagValues keys instead of taking a tag reference. For more information, see Monitor configuration.

Data type: VARIANT

'start_date'

Specifies the beginning of the time period for which consumption data is returned.

Data type: DATE

'end_date'

Specifies the end of the time period for which consumption data is returned.

Data type: DATE

Output

Returns a table with one row per day in the time period, with the following columns:

Column nameData typeDescription
USAGE_DATEDATEDay in UTC when the consumption occurred.
CONSUMPTIONNUMBERAmount of consumption attributed to the monitor on this day.
FORECASTED_CONSUMPTIONNUMBERPredicted consumption based on the anomaly-detecting algorithm.
CURRENCY_TYPEVARCHARUnit of measure for the consumption, which corresponds to the monitor’s credit family.
LOWER_BOUNDNUMBERPredicted lowest level of consumption based on the anomaly-detecting algorithm. Consumption levels below this value are considered anomalies.
UPPER_BOUNDNUMBERPredicted highest level of consumption based on the anomaly-detecting algorithm. Consumption levels above this value are considered anomalies.
IS_ANOMALYBOOLEANIf TRUE, consumption fell outside the range defined by the lower and upper bounds, so Snowflake identified it as a cost anomaly.
ANOMALY_IDVARCHARSystem-generated identifier for the anomaly. Empty when IS_ANOMALY is FALSE.
LAST_REFRESHED_ATTIMESTAMPTime when Snowflake last finished computing results for the monitor. This value is the same for every row.

Access control requirements

Users with any of the following roles can call this method:

  • ACCOUNTADMIN system role
  • GLOBALORGADMIN system role
  • SNOWFLAKE.APP_USAGE_ADMIN application role
  • SNOWFLAKE.APP_USAGE_VIEWER application role

Unlike ANOMALY_INSIGHTS!CREATE_MONITOR, this method doesn’t require the APPLYBUDGET privilege on the tags in the configuration.

Usage notes

  • This method names each tag directly rather than taking a tag reference, so you don’t call SYSTEM$REFERENCE to build the configuration. Nothing is saved and the configuration runs only one time, so no reference needs to be resolved.
  • The tag-name shape is the same one Snowflake returns when you read a configuration back, so you can pass a saved monitor’s configuration straight to this method.
  • The configuration must include at least one tag in resource_tags.tags or at least one entry in service_types. The method fails if it contains neither.
  • The results aren’t saved. To save a configuration as a monitor, use ANOMALY_INSIGHTS!CREATE_MONITOR, which takes tag references instead of tag names.
  • The method regenerates the full consumption time series and calculates any anomalies, so it takes longer to return than ANOMALY_INSIGHTS!GET_MONITOR_ANOMALIES.

Example

Test a configuration that tracks credits consumed by resources tagged with the department finance, along with all serverless task consumption in the account, for consumption between January 1, 2026, and March 31, 2026:

CALL SNOWFLAKE.LOCAL.ANOMALY_INSIGHTS!ADHOC_CALCULATE_ANOMALIES_FROM_CONFIG(
  PARSE_JSON('{
    "credit_family": "CREDITS",
    "resource_tags": {
      "operator": "UNION",
      "tags": [
        {
          "tagDatabase": "IT",
          "tagSchema": "WAREHOUSE_MANAGEMENT",
          "tagName": "DEPT",
          "tagValues": ["finance"]
        }
      ]
    },
    "service_types": ["SERVERLESS_TASK"]
  }'),
  '2026-01-01',
  '2026-03-31'
);