Cost Anomaly Detector

Paste a usage export and it groups by day, compares each day against the median and flags the outliers.

Paste a usage exportCSV or TSV, with a header row. Nothing you paste is uploaded or put in the URL — see below. The rows here are invented example data.

Flag a day aboveMultiple of the median day

× median

Rate, if your export has tokens but no costUS dollars per 1,000,000 tokens. Ignored when a cost column is found.

$/1M

Days flagged

1 of 14

The biggest day is 2026-06-09 at $144.20, 6.35× the median day of $22.72.

2026-06-09: $144.20 · 6.35× median

Rows parsed: 14
Date column used: date
Value column used: cost_usd
Days covered: 14
Total spend in the file: $416.03
Median day: $22.72
Mean day: $29.72
Mean ÷ median: 1.31×
Flag threshold (2× median): $45.44

What this assumes: Nothing you paste leaves this page. The parsing and the arithmetic run in your browser; there is no upload, no request and nothing stored. Check the network tab, or turn the connection off before you paste — the tool keeps working. The pasted text is also the one field kept out of the shareable URL, so a link you send carries the settings and not your usage. Days are grouped by whatever the date column holds, taking the date part of a timestamp; a file with one row per request and a file with one row per day both work. The comparison is against the MEDIAN day rather than the mean, because a spike drags a mean upward and hides itself — if mean ÷ median is well above 1 in the breakdown, your average is already being distorted. Numbers are read with a decimal point; a file using a decimal comma will parse wrong. Partial first and last days are counted as full days.

What counts as a spike

A cost spike is only visible against a baseline, and the baseline has to be robust or the spike hides inside it. That is why this compares each day against the median rather than the mean: one day at ten times normal pulls a two-week mean up by most of a day's spend, which is exactly enough to make the spike look like a two-sigma event instead of a catastrophe. The mean ÷ median line in the breakdown is a quick check — much above 1.2 and your dashboard's "average daily spend" is already being told a story by its outliers.

The threshold is a judgement, not a statistic. Two times the median is a reasonable default for daily spend on a stable workload; a business with a strong weekly cycle will trip it every Monday, and a business that is growing 20% a week will trip it eventually no matter what. If you get weekday false positives, compare like with like — same weekday, previous weeks — before you loosen the threshold, because a looser threshold is how a real spike gets through.

What a flag means is a separate question from what caused it. The usual causes are a prompt change that added context to every request, a retry loop that found a new way to fail, a model swap where the new model thinks for longer, a batch job someone ran once, and a key that leaked. Those look identical in a daily total and completely different one level down, which is why the next thing to do after a flag is to group the same export by feature or by key rather than by day.

Cost Anomaly Detector

What counts as a spike

The reasoning behind this

Related tools