true Monthly Billing Detailed Billing Cloudwatch (Estimated) true LinkedAccountId Account
Total Budget $earliest$ $latest$ Monthly Budget $earliest$ $latest$ Remaining Total Budget Budget Burndown accum cost as acost | eventstats sum(budget) as total | eval "Remaining Budget" = total-acost | rename cost as "Cost" | fields - budget total acost search?q=$drilldownSPL$&earliest=$earliest$&latest=$latest$ Budget eval cost = round(cost, 0) | eval budget = round($budget$, 0) | fillnull value=0 cost | eval balance=budget-cost | eventstats sum(balance) as total | eval monthly=if($remainMonth$>0,total/$remainMonth$,"N/A") | eval monthly=if(_time>now(),monthly,if(strftime(_time, "%Y-%m")=strftime(now(), "%Y-%m"), monthly, "")) | eval monthly=round(monthly) | rename cost as "Cost", budget as "Budget", monthly as "Remaining Monthly Budget" | fields - total balance search?q=$drilldownSPL$&earliest=$earliest$&latest=$latest$ Month-over-month Budget accum cost as "Accumulated Cost" | accum budget as "Accumulated Budget" | eval Balance = budget - cost | accum Balance as "Accumulated Balance" | rename cost as Cost, budget as Budget | fieldformat Cost=tostring(Cost,"commas") | fieldformat Budget=tostring(Budget,"commas") | fieldformat Balance=tostring(Balance,"commas") | fieldformat "Accumulated Cost"=tostring('Accumulated Cost',"commas") | fieldformat "Accumulated Balance"=tostring('Accumulated Balance',"commas") | eval Month = strftime(_time, "%Y-%m") | table Month Cost budget Balance "Accumulated Cost" "Accumulated Balance"