Splunk Search

AWS Bill month to date problem.

New Member

I am trying to build a query to display month to date usage cost per AvailabilityZone/Region. Unfortunately it won't give me current month to date or gives me totally false values (4x higher).

That one gives me costs for the previous month:
sourcetype="aws:billing" | search RecordType=LineItem | search AvailabilityZone!=Unspecified AvailabilityZone!=eu-west-1 AvailabilityZone!=us-east-1 AvailabilityZone!=us-west-2 | timechart span=1mon sum(BlendedCost) as TotalCost by AvailabilityZone limit=20 | eval TotalCost=round(TotalCost,2)

while this one gives me values four times higher than real one:

sourcetype="aws:billing" | search AvailabilityZone != Unspecified CurrencyCode=USD | stats sum(TotalCost) as TotalCost, first(CurrencyCode) as CurrencyCode by AvailabilityZone | eval TotalCost=round(TotalCost,2)

Tags (5)
0 Karma