Snowflake CCF - Tables populated with blank log entires

[sb312]

I am facing this issue . Receiving blank log entires. Did this issue get pushed to the main deployment or can I try this custom template as a fix?

Hi @mcentcw, We have made changes in template and now data is flowing with the values:

We are working on to push changes in Content Hub, Meantime, could you please do the custom deployment of the below shared main template and let us know after deployment still the data ingested as [].

Custom Deployment Steps: CustomDeploymentSteps (1).docx

Main Template: Snowflake mainTemplate-Fix.json

Kindly let us know once you done with the deployment and testing.

Thanks!

Originally posted by @v-sudkharat in #12625

[v-utpalkumar]

Hello @sb312, the logic to handle empty/redundant ([]) data ingestion has already been implemented and published. There’s no need for a custom deployment—just ensure you’re using the latest version (3.0.9).
If you’re still experiencing the empty/redundant ([]) data ingestion issue after updating it to the latest version and testing on your end, please feel free to reach out. Thank you!

Link: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Snowflake/Package/mainTemplate.json

Screenshot:

[sb312]

Thank you, I have the latest version 3.0.9 installed. Most tables are null entries although some records populate from time to time. Not consistently. The SnowflakeLogin_Cl and Snowflake_UserGrant_CL table aren't populating at all [cid:243f3ff4-82d0-49d7-92d3-ad96c66e6649][cid:1ef62cb7-7030-414f-a623-b523b82a20bf]

…

________________________________ From: v-utpalkumar ***@***.***> Sent: Monday, February 16, 2026 7:01 AM To: Azure/Azure-Sentinel ***@***.***> Cc: Bethel, Steve ***@***.***>; Mention ***@***.***> Subject: Re: [Azure/Azure-Sentinel] Snowflake CCF - Tables populated with blank log entires (Issue #13605) You don't often get email from ***@***.*** Learn why this is important<https://aka.ms/LearnAboutSenderIdentification> [This is an EXTERNAL email. Exercise caution. DO NOT open attachments or click links from unknown senders or unexpected email.] [https://avatars.githubusercontent.com/u/193235945?s=20&v=4]v-utpalkumar left a comment (Azure/Azure-Sentinel#13605)<#13605 (comment)> Hello @sb312<https://github.com/sb312>, the logic to handle empty/redundant ([]) data ingestion has already been implemented and published. There’s no need for a custom deployment—just ensure you’re using the latest version (3.0.9). If you’re still experiencing the empty/redundant ([]) data ingestion issue after updating it to the latest version and testing on your end, please feel free to reach out. Thank you! Link: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Snowflake/Package/mainTemplate.json Screenshot: image.png (view on web)<https://github.com/user-attachments/assets/05f9a98d-4682-4f4c-8ec9-af2e17b3fb1d> — Reply to this email directly, view it on GitHub<#13605 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/APSUS2IUFICVTY4VADN6AT34MGWP7AVCNFSM6AAAAACUVPFWKKVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTSMBYGEYDAMJXGU>. You are receiving this because you were mentioned.Message ID: ***@***.***>

[v-utpalkumar]

Hello @sb312, kindly share a screenshot illustrating the problem you’re facing. Thank you!

[sb312]

Our snowflake admin said the queries being sent by the connector aren't valid:

SELECT OBJECT_CONSTRUCT_KEEP_NULL(*) AS data FROM GRANTS_TO_ROLES WHERE CREATED_ON > '2026-02-17T11:50:53Z' AND CREATED_ON < '2026-02-17T12:00:53Z' ORDER BY CREATED_ON ASC

the query won't capture recent grants due to data latency in the GRANTS_TO_ROLES Account Usage view.
The GRANTS_TO_ROLES view has up to 2 hours (120 minutes) of latency
2
, meaning data is delayed by up to 2 hours before appearing in the view.

Why the Query Returns Nothing
Your query ran at 8:00:57 AM CST but searches for grants created between:
5:50:53 AM - 6:00:53 AM CST (11:50:53Z - 12:00:53Z UTC)
Due to the 2-hour latency, at 8:00 AM, the view likely only contains data up to ~6:00 AM CST. The 10-minute window you're querying (5:50-6:00 AM) is right at the edge of or still within the latency period, so those records may not yet be available.

should be:
SELECT OBJECT_CONSTRUCT_KEEP_NULL(*) AS data FROM SNOWFLAKE.ACCOUNT_USAGE.TABLES WHERE CREATED > '2026-02-17T12:30:53Z' AND CREATED < '2026-02-17T12:40:53Z' ORDER BY CREATED ASC ;