I wrote below query which will find aggregation based on Warehouse, Database, Users ,their Client IP and sum of query they run. Useful to find out who are the users who consuming most of the credits.
show warehouses;
WITH WAREHOUSE_SIZES AS (
SELECT 'X-Small' AS WAREHOUSE_SIZE, 1 AS CREDITS_PER_HOUR UNION ALL
SELECT 'Small' AS WAREHOUSE_SIZE, 2 AS CREDITS_PER_HOUR UNION ALL
SELECT 'Medium' AS WAREHOUSE_SIZE, 4 AS CREDITS_PER_HOUR UNION ALL
SELECT 'Large' AS WAREHOUSE_SIZE, 8 AS CREDITS_PER_HOUR UNION ALL
SELECT 'X-Large' AS WAREHOUSE_SIZE, 16 AS CREDITS_PER_HOUR UNION ALL
SELECT '2X-Large' AS WAREHOUSE_SIZE, 32 AS CREDITS_PER_HOUR UNION ALL
SELECT '3X-Large' AS WAREHOUSE_SIZE, 64 AS CREDITS_PER_HOUR UNION ALL
SELECT '4X-Large' AS WAREHOUSE_SIZE, 128 AS CREDITS_PER_HOUR),
WAREHOUSE_USAGE AS (
SELECT
"name" AS WAREHOUSE_NAME,
"size" AS WAREHOUSE_SIZE
FROM TABLE(RESULT_SCAN(LAST_QUERY_ID())) -- Result from SHOW WAREHOUSES
)
SELECT
qh.WAREHOUSE_NAME,
wu.WAREHOUSE_SIZE, -- Warehouse size
ws.CREDITS_PER_HOUR, -- Credits per hour based on warehouse size
qh.DATABASE_NAME,
qh.SCHEMA_NAME,
qh.USER_NAME,
LH.client_ip,
COUNT(*) AS ACCESS_COUNT, -- Number of queries executed
SUM(qh.TOTAL_ELAPSED_TIME / 1000) AS TOTAL_ELAPSED_SECONDS, -- Total elapsed time in seconds
SUM((qh.TOTAL_ELAPSED_TIME / (1000 * 60 * 60)) * ws.CREDITS_PER_HOUR) AS CREDIT_CHARGED -- Credits charged
FROM
SNOWFLAKE.ACCOUNT_USAGE.LOGIN_HISTORY LH
INNER JOIN
SNOWFLAKE.ACCOUNT_USAGE.QUERY_HISTORY QH
ON QH.USER_NAME = LH.USER_NAME
INNER JOIN
SNOWFLAKE.ACCOUNT_USAGE.SESSIONS S
ON S.SESSION_ID = QH.SESSION_ID
AND S.LOGIN_EVENT_ID = LH.EVENT_ID
LEFT JOIN
WAREHOUSE_USAGE wu
ON QH.WAREHOUSE_NAME = wu.WAREHOUSE_NAME
LEFT JOIN
WAREHOUSE_SIZES ws
ON wu.WAREHOUSE_SIZE = ws.WAREHOUSE_SIZE
WHERE
qh.START_TIME >= DATEADD(DAY, -30, CURRENT_TIMESTAMP) -- Last 30 days
GROUP BY
qh.WAREHOUSE_NAME,
wu.WAREHOUSE_SIZE,
ws.CREDITS_PER_HOUR,
qh.DATABASE_NAME,
qh.SCHEMA_NAME,
qh.USER_NAME,
LH.client_ip
ORDER BY
CREDIT_CHARGED DESC;