I am trying to build a query to display month to date usage cost per AvailabilityZone/Region. Unfortunately it won't give me current month to date or gives me totally false values (4x higher).
That one gives me costs for the previous month:
sourcetype="aws:billing" | search RecordType=LineItem | search AvailabilityZone!=Unspecified AvailabilityZone!=eu-west-1 AvailabilityZone!=us-east-1 AvailabilityZone!=us-west-2 | timechart span=1mon sum(BlendedCost) as TotalCost by AvailabilityZone limit=20 | eval TotalCost=round(TotalCost,2)
while this one gives me values four times higher than real one:
sourcetype="aws:billing" | search AvailabilityZone != Unspecified CurrencyCode=USD | stats sum(TotalCost) as TotalCost, first(CurrencyCode) as CurrencyCode by AvailabilityZone | eval TotalCost=round(TotalCost,2)
