DATA OPS

Alert on per-team BigQuery spend spikes after attribution

Reads the attributed BigQuery spend table, compares each team's daily bytes billed against its trailing baseline.

CategoryData Ops
Enginesim
Difficultyintermediate
Triggerschedule
Steps5
Setup~15 min

How it runs

The automated pipeline, trigger to output.

  • TriggerMorning schedule after attribution finalized
  • ActionRoll up yesterday's attributed spend by team in BigQueryGoogle BigQueryBigQuery
  • LogicCompare to trailing baseline; keep teams over threshold + floor
  • ActionFetch top costly query jobs for each flagged teamGoogle BigQueryBigQuery
  • OutputPost per-team spike alert to Slack with contextSlack

What it does

Turns clean per-team attribution into an early-warning signal: it rolls yesterday's attributed BigQuery spend up by team, compares it to each team's trailing average, and flags meaningful spikes.

When to use it

Run it once attribution is reliable. It catches the exploded backfill, the missing partition filter, or the runaway dashboard before it shows up as a surprise on the monthly invoice.

How it works

  1. 1A morning schedule fires after the prior day's attribution is finalized.
  2. 2Query the attribution table to total bytes billed and dollars per team for yesterday.
  3. 3Pull each team's trailing baseline (for example a 14-day median) from the same table.
  4. 4Branch: keep only teams whose spend exceeds the baseline by the configured multiplier and a dollar floor.
  5. 5For each flagged team, fetch its top query jobs by spend for context.
  6. 6Post a per-team Slack alert showing yesterday vs baseline, the delta, and the costliest queries to investigate.

Set it up

What you configure once, before turning it on.

  1. 1
    Connect BigQueryDatasets, queries, schemas.
  2. 2
    Connect SlackChannels, DMs, threads, mentions.
  3. 3
    Set each agent's modelWe leave models unset so you pick the tier — fast + cheap, or top-quality.
  4. 4
    Tune it to your dataEdit the prompts, filters, and field mappings so it matches how your team works.
  5. 5
    Test, then turn it onRun once against a sample, confirm the output, then enable the trigger.

Run this workflow in your colony.

14-day trial. No DevOps. No Sales call. Provisioned in under a minute.