Identify anomalous daily spending by subaccount and region

Postgres SQL, as run

select (charge_period_start at time zone 'UTC')::date as day,
       provider_name as provider_name,
       sub_account_id as sub_account_id,
       region_id as region_id,
       region_name as region_name,
       sum(effective_cost) as daily_effective_cost
from focus.cost_and_usage
where charge_period_start >= $1::timestamptz
  and charge_period_end < $2::timestamptz
group by (charge_period_start at time zone 'UTC')::date, provider_name, sub_account_id, region_id, region_name
order by daily_effective_cost desc nulls last, day asc, provider_name asc nulls last, sub_account_id asc nulls last, region_id asc nulls last, region_name asc nulls last
limit 500

Parameters: $1 = period_start, $2 = period_end

Original FOCUS SQL

SELECT
  DATE(ChargePeriodStart) AS Day,
  ProviderName,
  SubAccountId,
  RegionId,
  RegionName,
  SUM(EffectiveCost) AS DailyEffectiveCost
FROM focus_data_table
WHERE ChargePeriodStart >= ? and ChargePeriodEnd  < ?
GROUP BY
  DATE(ChargePeriodStart) AS StartDay,
  ProviderName,
  SubAccountId,
  RegionId,
  RegionName