Identify anomalous daily spending by subaccount, region, and service

This query uses the Provider column. Provider is deprecated in v1.3 and will be removed in v1.4.

FOCUS Versions

v1.0 v1.1 v1.2

Context

It is important for FinOps Practitioners to track daily spend from various angles to ensure any anomalous cost trends are easily detected. Tracking by region and service enables further granularity in understanding the source of anomalous spend. Purchases can often cause false positives, for this reason, we want to monitor cost trends with up-front payments amortized. Graphing the data by day in a multiline chart can often help find the outliers.

FOCUS SQL Query

SELECT
  DATE(ChargePeriodStart) AS Day,
  ProviderName,
  SubAccountId,
  RegionId,
  RegionName,
  ServiceName,
  SUM(EffectiveCost) AS DailyEffectiveCost
FROM focus_data_table
WHERE ChargePeriodStart >= ? and ChargePeriodEnd  < ?
GROUP BY
  DATE(ChargePeriodStart) AS StartDay,
  ProviderName,
  SubAccountId,
  RegionId,
  RegionName,
  ServiceName