index=aws_cur ProductCode=AmazonEC2 UsageAccountId="*" (UsageType="*BoxUsage*" OR UsageType="*SpotUsage*") CostCenter="xxx"
          | eval day=strftime(_time, "%d/%m/%Y")
          | dedup day date_hour ResourceId
          | stats sum(AmortizedUpfrontCostForUsage) AS TotalRI sum(UnblendedCost) AS TotalOnDemand sum(UsageAmount) AS TotalUsage BY ResourceId
          | rename ResourceId AS id
          | eval TotalRICost=round(TotalRI,2)
          | eval TotalUsageHour=round(TotalUsage,2)
          | eval TotalOnDemandCost=round(TotalOnDemand,2)
          | eval TotalCost=coalesce(TotalRICost,0)+coalesce(TotalOnDemandCost,0)
           | join id
                [ search `aws-description-resource( (aws_account_id="*") ,  (region="ap-southeast-2") , "ec2_instances")`
                | eval platform=if(platform=="null","linux",platform)
                | search tags.CostCenter="xxx"
                | eval date=strftime(_time, "%Y-%m-%d") ]
                | table account_id, tags.Name, id, instance_type, launch_time, state, cpu_cores, mem_capacity, platform, ip, tags.Environment, tags.ApplicationGroup, tags.Project, tags.CostCenter, tags.Backup, tags.AutoStart, tags.AutoStop, tags.AutoSnap, tags.Backup,TotalCost
                | rename tags.Name as Name
                | sort state tags.ApplicationGroup