<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic AWS Bill month to date problem. in Splunk Search</title>
    <link>https://community.splunk.com/t5/Splunk-Search/AWS-Bill-month-to-date-problem/m-p/444407#M126030</link>
    <description>&lt;P&gt;I am trying to build a query to display month to date usage cost per AvailabilityZone/Region. Unfortunately it won't give me current month to date or gives me totally false values (4x higher).&lt;/P&gt;

&lt;P&gt;That one gives me costs for the previous month:&lt;BR /&gt;
sourcetype="aws:billing" | search RecordType=LineItem | search AvailabilityZone!=Unspecified AvailabilityZone!=eu-west-1 AvailabilityZone!=us-east-1 AvailabilityZone!=us-west-2 | timechart span=1mon sum(BlendedCost) as TotalCost by AvailabilityZone limit=20 | eval TotalCost=round(TotalCost,2)&lt;/P&gt;

&lt;P&gt;while this one gives me values four times higher than real one:&lt;/P&gt;

&lt;P&gt;sourcetype="aws:billing" | search AvailabilityZone != Unspecified CurrencyCode=USD | stats sum(TotalCost) as TotalCost, first(CurrencyCode) as CurrencyCode by AvailabilityZone | eval TotalCost=round(TotalCost,2)&lt;/P&gt;</description>
    <pubDate>Tue, 12 Jun 2018 13:50:41 GMT</pubDate>
    <dc:creator>horizn</dc:creator>
    <dc:date>2018-06-12T13:50:41Z</dc:date>
    <item>
      <title>AWS Bill month to date problem.</title>
      <link>https://community.splunk.com/t5/Splunk-Search/AWS-Bill-month-to-date-problem/m-p/444407#M126030</link>
      <description>&lt;P&gt;I am trying to build a query to display month to date usage cost per AvailabilityZone/Region. Unfortunately it won't give me current month to date or gives me totally false values (4x higher).&lt;/P&gt;

&lt;P&gt;That one gives me costs for the previous month:&lt;BR /&gt;
sourcetype="aws:billing" | search RecordType=LineItem | search AvailabilityZone!=Unspecified AvailabilityZone!=eu-west-1 AvailabilityZone!=us-east-1 AvailabilityZone!=us-west-2 | timechart span=1mon sum(BlendedCost) as TotalCost by AvailabilityZone limit=20 | eval TotalCost=round(TotalCost,2)&lt;/P&gt;

&lt;P&gt;while this one gives me values four times higher than real one:&lt;/P&gt;

&lt;P&gt;sourcetype="aws:billing" | search AvailabilityZone != Unspecified CurrencyCode=USD | stats sum(TotalCost) as TotalCost, first(CurrencyCode) as CurrencyCode by AvailabilityZone | eval TotalCost=round(TotalCost,2)&lt;/P&gt;</description>
      <pubDate>Tue, 12 Jun 2018 13:50:41 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/AWS-Bill-month-to-date-problem/m-p/444407#M126030</guid>
      <dc:creator>horizn</dc:creator>
      <dc:date>2018-06-12T13:50:41Z</dc:date>
    </item>
  </channel>
</rss>

