Databricks SQL Alerts: Monitoring and Dashboard Operations

"I want to know immediately if sales drop more than 20% day-over-day." "I want an alert when the ETL ingestion row count is zero." Anomaly detection on business metrics like this is exactly what Databricks SQL Alerts are for. You set a condition on a SQL query's result and have it auto-notify Email, Slack, Webhook, etc. when the condition is met. This article walks through creating an Alert, designing the query, configuring destinations, and choosing between Alerts and Jobs Notifications.

SQL Alert Overview

A SQL Alert is made up of three components:

1. Query: The SQL query to evaluate (returns a numeric column)
2. Condition: Threshold check on the query result (e.g. value > 100, value == 0)
3. Destination: Where to send the notification when the condition is met (Email, Slack, Webhook, etc.)

An Alert runs the query on a schedule and evaluates the condition. It sends notifications while the condition is met and stops once the condition is no longer satisfied.

How to Create an Alert

Step 1: Create the monitoring query

In the Databricks SQL Editor, write a query that returns the metric you want to monitor. The Alert condition evaluates the first row / first column of the query result, so the query should be designed to return a single numeric value.

-- 例1: 直近1時間のエラー件数を監視
SELECT COUNT(*) AS error_count
FROM catalog.schema.application_logs
WHERE log_level = 'ERROR'
  AND event_time > CURRENT_TIMESTAMP() - INTERVAL 1 HOUR;

-- 例2: 日次ETLの取込件数がゼロかを監視
SELECT COUNT(*) AS ingested_rows
FROM catalog.schema.daily_ingestion_log
WHERE ingestion_date = CURRENT_DATE();

-- 例3: 売上の前日比を監視
SELECT
  (today.total_sales - yesterday.total_sales) / yesterday.total_sales * 100
    AS daily_change_pct
FROM (
  SELECT SUM(amount) AS total_sales
  FROM catalog.schema.sales
  WHERE order_date = CURRENT_DATE()
) today
CROSS JOIN (
  SELECT SUM(amount) AS total_sales
  FROM catalog.schema.sales
  WHERE order_date = CURRENT_DATE() - INTERVAL 1 DAY
) yesterday;

Step 2: Configure the Alert condition

In the Databricks SQL UI, open the "Alerts" section, create a new Alert, and configure the following:

Notification frequency matters. With "Just once," you get a notification only the first time the condition is met; you are not re-notified while the condition continues. If the condition clears and then triggers again, you get re-notified. With "Every time," you get a notification every time the condition is evaluated as true.

Step 3: Configure the notification destination

Configure where notifications are sent when the Alert is triggered.

Configuring Alert Destinations

Email can go directly to Databricks users, but Slack, Webhook, and PagerDuty require an administrator to set up an "Alert Destination" in advance.

Setting up the Slack integration

1. On the Slack side, issue an Incoming Webhook URL
2. In Databricks SQL, open SQL Admin Console → Alert Destinations
3. Click "New Alert Destination" and choose Slack
4. Enter the Webhook URL and give the destination a name
5. Select the destination you created when configuring the Alert

Webhook integration payload

The JSON payload sent to the Webhook includes the following fields:

{
  "alert_id": "abc-123",
  "alert_name": "daily_error_count_high",
  "alert_state": "triggered",
  "alert_url": "https://workspace.databricks.com/sql/alerts/abc-123",
  "query_name": "daily_error_count",
  "query_url": "https://workspace.databricks.com/sql/queries/xyz-456",
  "column": "error_count",
  "value": 152,
  "threshold": 100,
  "condition": "above"
}

Practical Alert Design Patterns

Pattern 1: Data freshness monitoring

-- テーブルの最終更新からの経過時間（時間単位）
SELECT
  TIMESTAMPDIFF(HOUR, MAX(updated_at), CURRENT_TIMESTAMP()) AS hours_since_update
FROM catalog.schema.fact_orders;
-- Alertの条件: hours_since_update > 4（4時間以上未更新で通知）

Pattern 2: Data quality monitoring

-- NULL率が閾値を超えたら通知
SELECT
  COUNT(CASE WHEN customer_id IS NULL THEN 1 END) * 100.0 / COUNT(*)
    AS null_rate_pct
FROM catalog.schema.transactions
WHERE transaction_date = CURRENT_DATE();
-- Alertの条件: null_rate_pct > 5（NULL率5%超で通知）

Pattern 3: Cost anomaly monitoring

-- 日次DBU消費量が直近7日平均の1.5倍を超えたら通知
WITH daily AS (
  SELECT usage_date, SUM(usage_quantity) AS daily_dbu
  FROM system.billing.usage
  WHERE usage_date >= CURRENT_DATE() - INTERVAL 8 DAY
  GROUP BY usage_date
)
SELECT
  MAX(CASE WHEN usage_date = CURRENT_DATE() THEN daily_dbu END)
    / AVG(CASE WHEN usage_date < CURRENT_DATE() THEN daily_dbu END) AS ratio
FROM daily;
-- Alertの条件: ratio > 1.5

Alert vs Job Notification: Comparison

Key Points for the Exam

• "How to notify when a query result meets a specific condition" → SQL Alert
• "Which value does the Alert evaluate from the query result?" → The specified column of the first row
• "What is an Alert Destination?" → A registered external notification target such as Slack / Webhook / PagerDuty
• "Difference between Alert and Job Notification" → Alert = condition notification based on query results; Job Notification = notification based on job state

Check Your Understanding

Frequently Asked Questions