Hey, thanks! I tried your exact query. Only substituting the actual account number for '123456789'. And for some reason the "Total Cost" label isn't applied. It's still showing a total for the column, but with no label.
It's nice to have that. But nicer with the label! Here's my exact query again just so you can see!
index=prd_aws_billing (source="/*2017-10.csv") LinkedAccountId="1234567890" ProductName="Amazon Elastic Compute Cloud"
| stats sum(UnBlendedCost) AS Cost by ResourceId,UsageType,user_Name,user_Engagement
| rename ResourceId as "AWS Resource Name" UsageType as "Usage Type" user_Name as "Resource Name" user_Engagement as Engagement
| addcoltotals Cost label="Total Cost"
| eval Cost=round(Cost,2)
| fieldformat Cost="$".tostring(Cost)
Any ideas? Thanks again!
... View more