Snowflake receiver stops collecting metrics after changing to PAT authentication

Applicability

Splunk Distribution of the OpenTelemetry Collector OpenTelemetry Collector with the snowflake receiver Snowflake Programmatic Access Token (PAT) authentication Environments where Snowflake session lifetime is shorter than, or equal to, the receiver collection interval

Description

After migrating the Snowflake receiver from username/password authentication to Programmatic Access Token (PAT) authentication, metrics can initially flow to Splunk Observability Cloud and later stop without the OpenTelemetry Collector service stopping.

The receiver can report errors similar to the following:

 

390111: Session no longer exists
390114: Authentication token has expired. The user must authenticate again.

A PAT can remain valid while the Snowflake session created by that authentication expires. If the receiver’s collection_interval is longer than the Snowflake session timeout, the next metric scrape can attempt to use an expired session.

For example, this issue can occur when:

 

• Snowflake session timeout: 30m
• Snowflake receiver collection_interval: 60m

 

The receiver remains running, but Snowflake metric collection can fail until the Collector is restarted or a new valid session is established.

 

Investigation

1. Confirm the Snowflake receiver errors

Review the OpenTelemetry Collector logs for Snowflake session or authentication errors:

Error scraping metrics
390111: Session no longer exists
390114: Authentication token has expired. The user must authenticate again.

These errors occurring after a period of successful collection indicate that the Snowflake session may have expired between scrape cycles.

 

2. Check the Snowflake session timeout

 

Confirm the configured Snowflake session timeout with the Snowflake administrator or team responsible for Snowflake security policies.

 

For example:

Snowflake session timeout: 30m

3. Check the receiver collection interval

 

Review the Collector configuration, such as agent_config.yaml, and locate the Snowflake receiver configuration:

receivers:
  snowflake:
    collection_interval: 60m

Compare collection_interval with the Snowflake session timeout.

If the collection interval is greater than the session timeout, the session can expire while the receiver is idle. If the values are equal, there is little tolerance for timing or scheduling delays.

Resolution

Configure a shorter collection interval

Set the Snowflake receiver collection_interval to a value comfortably below the Snowflake session timeout.

For a Snowflake session timeout of 30m, use an interval such as 10m or 15m where operational requirements allow.

receivers:
  snowflake:
    collection_interval: 10m
    authenticator: SNOWFLAKE_PAT

Ensure the configured authenticator is appropriate for the environment’s PAT configuration.

 

Restart the OpenTelemetry Collector

 

After updating the configuration, restart the OpenTelemetry Collector using the method appropriate for the deployment.

For example, for a systemd-managed Collector:

sudo systemctl restart splunk-otel-collector

Validate continued collection

 

After restarting the Collector:

 

1. Confirm Snowflake metrics resume in Splunk Observability Cloud.
2. Monitor the receiver logs for 390111 and 390114.
3. Confirm collection continues beyond the previous failure period.
4. Continue monitoring for at least one Snowflake session-timeout period.

 

Alternative option

If organisational policy permits, increase the Snowflake session timeout to exceed the required receiver collection interval. If the Snowflake session policy cannot be changed, reduce the receiver collection interval instead.

Revision History

Revision	Publish Date	Comments
1.0	20-Oct-2026	Initial Release