Skip to Content
ReferenceQuery Audit Trail

Query Audit Trail

Skoot adds a small JSON comment to each query it runs so you can trace where the query came from.

Comment Format

/*{"source":"chat_run_query","metadata":{"chatId":"chat_123","userId":"user_1","userName":"Mina Clarke"}}*/

Example Queries with Trace Comments

Chat Query

SELECT count(*) AS total_orders FROM orders /*{"source":"chat_run_query","metadata":{"chatId":"chat_123","userId":"user_1","userName":"Mina Clarke"}}*/;

Connection Test

SELECT 1 /*{"source":"connection_test_api","metadata":{"userId":"user_1","userName":"Mina Clarke"}}*/;

Schema Refresh

SELECT schema_name FROM information_schema.schemata /*{"source":"schema_refresh_discover","metadata":{}}*/;

Common Source Labels

  • chat_run_query
  • data_sources_query_api
  • connection_create_validation
  • connection_update_validation
  • connection_test_api
  • schema_refresh_discover

Verify in Query History

ClickHouse

SELECT event_time, type, user, query_id, query FROM system.query_log WHERE position(query, '/*{"source"') > 0 ORDER BY event_time DESC LIMIT 100;

Postgres

SELECT calls, total_exec_time, left(query, 300) AS query_prefix FROM pg_stat_statements WHERE query ILIKE '%"source":"%' ORDER BY total_exec_time DESC LIMIT 100;

BigQuery

SELECT creation_time, user_email, job_id, query FROM `region-us`.INFORMATION_SCHEMA.JOBS_BY_PROJECT WHERE creation_time >= TIMESTAMP_SUB(CURRENT_TIMESTAMP(), INTERVAL 1 DAY) AND job_type = 'QUERY' AND query LIKE '%"source":"%' ORDER BY creation_time DESC LIMIT 100;

Snowflake

SELECT start_time, user_name, query_id, query_text FROM TABLE( INFORMATION_SCHEMA.QUERY_HISTORY( END_TIME_RANGE_START => DATEADD(day, -1, CURRENT_TIMESTAMP()), RESULT_LIMIT => 1000 ) ) WHERE query_text ILIKE '%"source":"%' ORDER BY start_time DESC;
Last updated on