What drove the change, measured rather than guessed

Every month someone asks the same question: spend went up, so what moved it? The usual answer is a chart of the biggest services, a guess about which team launched something, and a promise to look into it. This post is about answering that question exactly: dividing a change in spend by every dimension at once, so the parts add up to the change, and nothing is a guess.

The question behind every cost review

A change in spend is a single number: the month cost $12,430 more than the month before. Finance needs to know who it belongs to. Engineering needs to know what to look at. A chart of the five largest services rarely answers either, because the largest service is not always the one that moved, and a service is rarely who the money was for.

What people actually want is a split: of the $12,430, how much came from each team, each service, each customer, each account. And they want it to add up, so nobody spends a meeting arguing about the part that went unaccounted for.

Like for like first

A change is only meaningful between comparable periods. A month under way compared with a whole month always looks like a fall. So when either month is not over, CostReveal compares both through the same day, the last day billed in the month under way: October 1 to 12 against September 1 to 12. Both months are read at the same exchange rates, the shown month's, so a change is what spend did, not what rates did.

That holds on every dimension, owners included, because CostReveal keeps who each cost is for by the day it was used. A team's spend through the 12th is a real figure, not a share of a month estimated after the fact.

Every dimension at once

In Explore, any view compared with another month shows What drove the change under the table. It divides the change by every other dimension at once: provider, team, service, account, region, model, feature, customer and user, each custom dimension such as environment, and a Kubernetes cluster's namespaces and workloads where the project has one. Choose the dimension under Drivers by.

Each dimension lists the five values that moved spend most, up or down, and the rest together as Everything else. Its rows add up to the change exactly. A team that moved spend by $8,200 shows $8,200; there is no rounding gap, and no unexplained remainder to wave away.

Spend that no evidence names an owner for is its own row, Not yet explained, as everywhere in CostReveal. If a rise came from untagged resources, the drivers say so, instead of spreading it across teams that did nothing.

Exact, because of how it is read

The drivers are not a model's estimate. Each figure is the one Explore shows for that value, in both months, read from what each day's spend is attributed to. That is why they add up: the change by team and the change by service are two ways of dividing the same billed lines.

A dimension that covers only part of spend, such as the model, which only AI spend has, says what its rows add up to. The drivers also stay within the view's filters: look at the payments team's spend on EC2, and the drivers explain that change, not the whole project's.

The same answer everywhere

The same engine answers the question wherever it comes up:

• Explore, for any comparison: the month before, a year before, or any month with figures.
• Insights, for an anomaly: a day a service spent outside its normal range is divided the same way, against the average of the same weekday over the four weeks before.
• Cost spike alerts, which name the team, account or workload whose spend rose most, in the alert itself.
• Reports: an Overview or Explore report adds what changed from the month before, so people who never open CostReveal get the same answer.

One method, so the answer in a report, an alert and Explore never disagree.

What it does not claim

The drivers say what moved spend, measured. They do not say why: a team's EC2 spend rose by $8,200 is a fact; whether that was a launch, a leak or a load test is for the team to say. Splitting a change into volume and price is not offered, because that needs usage quantities by day that no rollup keeps, and CostReveal states only what it has.

Frequently asked questions

Does it work for a month that is not over? Yes. Both months are read through the same day, the last day billed in the month under way.

Which dimensions can it divide by? Provider, team, service, account, region, model, feature, customer, user, every custom dimension, and a cluster's namespaces and workloads where the project has one.

Why do the rows always add up? Each figure is read from the same billed lines as Explore's own grouping, and Everything else holds every value beyond the five that moved most.

What happens to spend nobody owns? It is its own row, Not yet explained, never spread across owners.

Do exchange rates distort the change? No. Both months are read at the shown month's rates.

Can I see it in alerts? Yes. A cost spike alert names what drove the rise, and Insights divides each anomaly the same way.

Keep reading

• Why CostReveal shows the spend it cannot explain: how unknown spend is kept in the open.
• Budgets that forecast from their own spend: a team's forecast follows the team.
• CostReveal vs CloudZero: how two platforms treat spend that cannot be attributed.