Snowflake - Dovetail

Overview

The Snowflake integration imports rows from Snowflake tables. For each table, you choose the column that uniquely identifies a row, the column that holds its timestamp, and the column that holds the text Dovetail analyzes. Every other column comes across as a field you can filter by. Each table you add becomes a dataset. Snowflake connects with key-pair authentication rather than a sign-in. You set up a Snowflake service user with a key pair, then give Dovetail its private key. Dovetail only reads from Snowflake.

To	Who	See
Connect Snowflake to Dovetail	A workspace admin	Create the Snowflake source
Add Snowflake data to a channel	Users with Can use on the source who can edit the channel	Channel setup
Use Snowflake when it isn’t available to you	Any user	Request a source

A workspace admin creates the Snowflake source once for the whole workspace, and channels then add its tables. Learn more about Sources →

If your workspace doesn’t have Sources, see Connect a tool without Sources. Complete Before you start and Step 1 on this page first.

Before you start

In Dovetail

A workspace admin creates the source. Other users can request it.
The credentials you connect with are shared by the whole workspace. See Shared credentials for how to choose an account.

In Snowflake

Privileges to create a role and a user, such as SECURITYADMIN or ACCOUNTADMIN, and to grant read access to the tables you want to import. Alternatively, use an existing service user that’s already set up for key-pair authentication.
A service user with key-pair authentication and SELECT on the table. The next section walks through the setup.
A table with the three columns Dovetail needs: a unique identifier, a timestamp, and the text to analyze. See Column type restrictions.
A tool that generates RSA key pairs, such as openssl.

We recommend a dedicated, read-only Snowflake user for Dovetail, scoped to only the warehouse, database, schema, and tables you want to import.

Step 1 — Set up a Snowflake service user

Do this once in Snowflake. A SECURITYADMIN or ACCOUNTADMIN typically runs it. It creates a dedicated read-only role and user, then registers a key pair on that user. Adjust the object names to match your account.

Create a read-only role and grant minimal access

-- A dedicated role with only the access Dovetail needs
CREATE ROLE IF NOT EXISTS DOVETAIL_RO;

GRANT USAGE ON WAREHOUSE DEV_WAREHOUSE   TO ROLE DOVETAIL_RO;
GRANT USAGE ON DATABASE  MY_DB           TO ROLE DOVETAIL_RO;
GRANT USAGE ON SCHEMA    MY_DB.MY_SCHEMA TO ROLE DOVETAIL_RO;

-- SELECT on the specific table(s) you'll import…
GRANT SELECT ON TABLE MY_DB.MY_SCHEMA.MY_TABLE TO ROLE DOVETAIL_RO;

-- …or, to allow importing any table in the schema (current and future):
-- GRANT SELECT ON ALL TABLES    IN SCHEMA MY_DB.MY_SCHEMA TO ROLE DOVETAIL_RO;
-- GRANT SELECT ON FUTURE TABLES IN SCHEMA MY_DB.MY_SCHEMA TO ROLE DOVETAIL_RO;

Generate a key pair

Generate an unencrypted PKCS#8 private key and its public key:

# Private key (unencrypted PKCS#8 — this is what you paste into Dovetail)
openssl genrsa 2048 | openssl pkcs8 -topk8 -nocrypt -out dovetail_key.p8

# Public key (this goes on the Snowflake user)
openssl rsa -in dovetail_key.p8 -pubout -out dovetail_key.pub

Dovetail’s connection form accepts an unencrypted private key. The form has no passphrase field, so passphrase-protected keys aren’t supported. Don’t add -passout or encryption when you generate the key.

Create the user and register the public key

Copy the public key body without the -----BEGIN PUBLIC KEY----- and -----END PUBLIC KEY----- lines and without line breaks, then run:

CREATE USER IF NOT EXISTS DOVETAIL_USER
  DEFAULT_ROLE      = DOVETAIL_RO
  DEFAULT_WAREHOUSE = DEV_WAREHOUSE
  COMMENT           = 'Read-only service user for Dovetail';

GRANT ROLE DOVETAIL_RO TO USER DOVETAIL_USER;

-- Register the PUBLIC key (paste the key body, no header/footer lines)
ALTER USER DOVETAIL_USER SET RSA_PUBLIC_KEY='MIIBIjANBgkqhk...';

You paste the private key into Dovetail when you create the source. For background on Snowflake’s key-pair authentication, see Snowflake’s key-pair authentication docs.

If you leave Role (optional) blank in Dovetail, Snowflake uses the user’s default role. Make sure the role that carries these grants is the user’s DEFAULT_ROLE, or enter that role in Dovetail.

Create the Snowflake source

Open Sources and select Snowflake

In the sidebar, select Sources, then select Snowflake. If your workspace already has a working Snowflake connection, Dovetail skips the connection form.

Connect Snowflake

Enter the connection details:

Account identifier — your Snowflake account, for example MYORG-MYACCOUNT, or an account locator such as xy12345.
Username — the service user, for example DOVETAIL_USER.
Warehouse — the warehouse Dovetail runs its queries on, for example DEV_WAREHOUSE.
Role (optional) — the role to use. If you leave it blank, the user’s default role applies.
Private key (PEM) — the full contents of dovetail_key.p8, including the -----BEGIN PRIVATE KEY----- and -----END PRIVATE KEY----- lines.

Select Connect.

Choose a table and an import period

In Fully-qualified table name, enter the table as DATABASE.SCHEMA.TABLE, for example MY_DB.MY_SCHEMA.FEEDBACK, then select Load columns. Choose a different column for each of Unique identifier, Timestamp, and Text to analyze. See Column type restrictions. Then choose an Import period. See Import period.You add one table here, and you can add more after the source is created.

Choose who can use the source

Choose who can use the source, then select Next. See Create a source.

Create the source

Choose whether to auto-redact sensitive information in the source’s data, then select Create source. The first import starts right away. See Redact data from sources.

Authentication and permissions

Snowflake uses key-pair authentication. Dovetail connects as your service user and signs in with the private key you entered. Access ends when you unset the public key, drop the user, or revoke the role’s grants in Snowflake. Dovetail runs only SELECT and DESCRIBE TABLE queries, and doesn’t write anything to Snowflake. Queries run on the warehouse you entered, under the role you entered or the user’s default role, so the role’s grants limit what Dovetail can read. The Snowflake connection is stored once for the whole workspace. To change the account or credentials, see Reconnect a source.

Datasets

Each table you add becomes its own dataset and syncs on its own, so a problem with one table doesn’t stop the others. You add one table while you create the source. A Snowflake source can hold up to 25 tables, and a channel can add some or all of them. You can’t change a table’s column mapping after you add it. To use different columns, delete the table from the source and add it again. See Delete a dataset for what deleting removes. To add more tables later, open the source and select Add table. See Add datasets.

Column type restrictions

Each column role accepts only certain Snowflake column types, and its menu lists only the columns that match:

Column role	Allowed Snowflake column types
Unique identifier	Any column type
Timestamp	`TIMESTAMP`, `TIMESTAMP_NTZ`, `TIMESTAMP_LTZ`, `TIMESTAMP_TZ`, `DATE`, `TIME`
Text to analyze	`VARCHAR`, `STRING`, `TEXT`, `CHAR`

Dovetail converts the table name you enter to uppercase, so a table whose name was created in double quotes with lowercase letters or other characters can’t be loaded.

What gets imported

Each row in a table becomes one data point.

Always imported

Data point field	From
Title	Your Text to analyze column, shortened to 120 characters
Text Dovetail analyzes	Your Text to analyze column, in full
Date	Your Timestamp column
External ID	The table name and your Unique identifier column, so two tables can use the same ID values without clashing

Imported when present

Every other column in the table becomes a field on the data point, named after its column in sentence case, so OPERATING_SYSTEM becomes “Operating system”. Dovetail sets the field type from the column type:

Snowflake column type	Field type
`BOOLEAN`	Checkbox
`NUMBER`, `FLOAT`, `DOUBLE`, and `REAL`, including aliases such as `INT` and `DECIMAL`	Number
`TIMESTAMP` types, `DATE`, and `TIME`	Date
`VARCHAR` and its aliases	Text
`VARIANT`, `OBJECT`, `ARRAY`, `BINARY`, `GEOGRAPHY`, `GEOMETRY`, and any other type	Text

Values in semi-structured, binary, and geospatial columns might not import. If you need one of those columns, convert it to a VARCHAR column. To rename the fields above or change their types, see Source fields.

Not imported

Rows with an empty Unique identifier or Text to analyze cell, or with a Timestamp that can’t be read as a date.
Edits to a row that don’t change its timestamp. See Sync behavior.
Contact links. Snowflake rows aren’t linked to contacts, even when a column holds an email address.

Scores and field types

Dovetail doesn’t set the NPS or CSAT type on Snowflake fields. A numeric score column, such as an NPS or CSAT score, arrives as a Number field. To chart scores in Dashboards, the field must use the NPS or CSAT type. See NPS and CSAT scores for Dashboards.

Sync behavior

The first import starts when the source is created. After that, the source syncs about every hour. See Manage a source.

Import period. The import period applies to the Timestamp column.
Ongoing sync. Each sync imports the rows whose timestamp is later than the latest timestamp already imported from that table.
Choose the timestamp column carefully. Rows added later with an earlier timestamp are never imported, and edits to a row that don’t change its timestamp aren’t imported either. Use a timestamp that’s set when a row is created and only moves forward, such as a created-at column.
Warehouse. Syncs use the compute of the warehouse in the connection.

Troubleshooting

Snowflake rejects the connection. Check that you registered the public key on the Snowflake user, that you pasted the matching private key into Dovetail, and that the account identifier and username are correct. “Couldn’t connect to Snowflake.” Check the Account identifier format, for example MYORG-MYACCOUNT or an account locator such as xy12345, without https:// or a path. Then check the Warehouse name, and that the role has USAGE on that warehouse. “Must be a PKCS#8 private key.” Paste the whole unencrypted PKCS#8 key, including its -----BEGIN PRIVATE KEY----- and -----END PRIVATE KEY----- lines. The table’s columns don’t load. Enter the table as DATABASE.SCHEMA.TABLE, and check that the role has USAGE on the database and schema, and SELECT on the table. See Column type restrictions. A column I want doesn’t appear in a menu. The Timestamp and Text to analyze menus list only columns of a compatible type. See Column type restrictions. A table shows “Snowflake rejected the query” or “The configured Snowflake table can’t be found.” Check that the table still exists under the same name, and that the role Dovetail uses still has USAGE on the warehouse, database, and schema, and SELECT on the table. If the table was renamed, add it to the source again under its new name. The source is connected, but no rows import. Check that:

The role has USAGE on the warehouse, database, and schema, and SELECT on the table.
The table has rows with a timestamp within the import period, or later than the rows already imported. See Get older data.
The rows have a unique identifier, text to analyze, and a timestamp Dovetail can read. Rows missing any of them are skipped.
The channel includes the table’s dataset. See Missing or outdated data.

Data stopped arriving, and I didn’t get a notification. Snowflake sources don’t send a notification when they need reconnecting, so check the source’s status on the Sources page. See Reconnect a source. Snowflake isn’t available when I set up a channel. See Troubleshoot sources.

Revoke access in Snowflake

Pausing or deleting the source in Dovetail doesn’t change anything in Snowflake. To cut off Dovetail’s access, unset the public key on the service user, or drop the user:

ALTER USER DOVETAIL_USER UNSET RSA_PUBLIC_KEY;
-- or
DROP USER DOVETAIL_USER;

To limit what the source can read without cutting off access, revoke grants from its role instead. To pause or delete the source in Dovetail, see Manage a source. To take its data out of one channel, see Channel setup.

Sources

What a source is, and how its data reaches channels.

Channel setup

Add the source’s tables to a channel, or remove them.

Manage a source

Check a source’s status, sync it, pause it, or add tables.

Voice of customer

Bring Snowflake rows together with other customer feedback in Channels.

​Overview

​Before you start

​In Dovetail

​In Snowflake

​Step 1 — Set up a Snowflake service user

​Create a read-only role and grant minimal access

​Generate a key pair

​Create the user and register the public key

​Create the Snowflake source

​Authentication and permissions

​Datasets

​Column type restrictions

​What gets imported

​Always imported

​Imported when present

​Not imported

​Scores and field types

​Sync behavior

​Troubleshooting

​Revoke access in Snowflake

​Related guides

Sources

Channel setup

Manage a source

Voice of customer

Overview

Before you start

In Dovetail

In Snowflake

Step 1 — Set up a Snowflake service user

Create a read-only role and grant minimal access

Generate a key pair

Create the user and register the public key

Create the Snowflake source

Authentication and permissions

Datasets

Column type restrictions

What gets imported

Always imported

Imported when present

Not imported

Scores and field types

Sync behavior

Troubleshooting

Revoke access in Snowflake

Related guides