The ★10 checklist

One row = a cloud + SKU + usage_unit's DBU spend for the window, priced two ways. The columns that matter are net_default_cost (what you are estimated to actually pay) and net_list_cost (undiscounted list price) - the smaller the gap between them, the less discount you are realizing on that SKU.

Flag ifrealization ratio at/above :warn_realization_ratio (WARN) or :crit_realization_ratio (CRITICAL) - you are paying close to list price on that SKU; or either cost column is NULL (NOT_ASSESSED - a priced-coverage gap, not $0).

One row = a day + workspace + job's DBU cost. The columns that matter are job_id (which job) and net_usage_quantity (its DBU burn that day) - distinct_runs lets you tell a job that is expensive because it runs constantly apart from one that is expensive because a single run is heavy.

Flag ifnet_usage_quantity at/above :warn_job_dbus_per_day (WARN) or :crit_job_dbus_per_day (CRITICAL) DBUs/day - field heuristic; a job that is consistently in-band and just large may be fine, a job whose per-run cost keeps climbing is the one to open first.

One row = a day + workspace + product + tag key/value pair's DBU usage, including a row per tag_key = NULL where a resource carried no tags at all. The columns that matter are tag_key/tag_value (a real chargeback cut needs a key whose values actually vary) and net_usage_quantity - pair the NULL-tag rows against cost_totals_by_sku_day's total for the same window to get the untagged share.

RecordInventory / trust query — note the value; there is no pass/fail band.

One row = a day + cloud + SKU + product + usage type/unit's usage, priced at list. The columns that matter are net_usage_quantity (the native-unit volume) and net_list_cost (usage_quantity x the list rate) - this is a pre-discount estimate, not what you actually pay.

RecordInventory / trust query — note the value; there is no pass/fail band.

One row = a day + cloud + SKU + product's usage cut by serverless/Photon/tier choice. The columns that matter are is_serverless, is_photon, and the *_tier columns (which premium lever, if any, applied) against net_usage_quantity (how much usage ran through that lever).

Flag ifA sku_name/product with a large, growing net_usage_quantity on rows where is_serverless/is_photon = true or a *_tier is a premium tier - compare it against that SAME sku_name's classic rows before assuming the premium is unjustified, since raw volumes are not comparable across different SKUs' units.

One row = one heavy FINISHED statement. execution_duration_ms is the column that matters (Databricks has no per-query dollar column; warehouse DBUs are allocated in proportion to it, so ranking by it ~= ranking by cost within one warehouse). pct_of_warehouse_exec_ms shows how much of that warehouse's total execution time this single statement ate; statement_fingerprint groups repeat shapes.

Flag ifpct_of_warehouse_exec_ms at/above :warn_wh_share (WARN) or :crit_wh_share (CRITICAL) - one statement shape eating a large share of a warehouse's execution time (field heuristic).

One row = one SQL warehouse's time spent in each event state (RUNNING, STARTING, STOPPED) over the window, computed as the gap from each event to that warehouse's very next event (any type). The columns that matter are running_seconds (total time the warehouse sat RUNNING before its next event - a mix of active query time and the idle tail before auto-stop, since per-query activity is deliberately not joined into this query) and max_running_gap_seconds (the single longest continuous RUNNING stretch - an unusually long one usually means the warehouse never triggered its own auto-stop for a long time).

Flag ifstatus = WARN or CRITICAL (a single RUNNING stretch at or above :warn_idle_hours / :crit_idle_hours) - field heuristic. status = NOT_ASSESSED means this warehouse had zero RUNNING events in the window (running_seconds=0), which this query still surfaces rather than dropping, since an unused warehouse is itself worth a look.

One row = a job with at least one failed run in the window. The column that matters is wasted_dbus_proxy - the job's net DBUs scaled by the share of its runs that failed; est_usd_list turns that into a rough list-price dollar figure. last_failed_termination_code tells you why the most recent failure happened.

Flag iffailed_runs at/above :warn_failed_runs or wasted_dbus_proxy at/above :warn_wasted_dbus (WARN); either at/above :crit_failed_runs / :crit_wasted_dbus (CRITICAL) - field heuristic.

One row = one (job, all-purpose cluster) placement over the window. cluster_source is the column that matters - UI or API means the job ran on an interactive/all-purpose cluster (the anti-pattern) instead of a cheaper jobs cluster. est_usd_list_share is a naive even split of the shared cluster's list-price cost across the jobs on it.

Flag ifcluster_source IN ('UI','API') (WARN), especially with est_usd_list_share at/above :crit_share_usd (CRITICAL) - a job pinned to an always-on interactive cluster (field heuristic). The trailing NOT_ASSESSED summary row counts runs dropped for null compute_ids; do not read those as "clean".

One row = a masked run_by/run_as identity pair x service x action, where the principal that initiated an action (run_by) differs from the identity it executed as (run_as). The column that matters is event_count - how often that specific pair fired in the window.

Flag ifstatus = WARN at/above :warn_runas_events, CRITICAL at/above :crit_runas_events - field heuristic; also treat a ZERO-ROW result with suspicion rather than relief - see caveats.