-- Identify the most-used databases by query volume over the last 30 days.
-- These are the priority targets for governance enforcement.

SELECT
    DATABASE_NAME,
    COUNT(*) AS QUERY_COUNT,
    COUNT(DISTINCT USER_NAME) AS DISTINCT_USERS,
    MIN(START_TIME) AS EARLIEST_QUERY,
    MAX(START_TIME) AS LATEST_QUERY
FROM SNOWFLAKE.ACCOUNT_USAGE.QUERY_HISTORY
WHERE START_TIME >= DATEADD('day', -30, CURRENT_TIMESTAMP())
  AND DATABASE_NAME IS NOT NULL
  AND DATABASE_NAME NOT IN ('SNOWFLAKE', 'SNOWFLAKE_SAMPLE_DATA')
  AND DATABASE_NAME NOT LIKE 'USER$%'
GROUP BY DATABASE_NAME
ORDER BY QUERY_COUNT DESC
LIMIT 10;
