The evidence is spread across Workspace tools—and BigQuery still needs careful SQL

What the sources establish

1. Email Log Search, Gmail log events, the Reports API and BigQuery export are distinct evidence surfaces with different access paths.
2. Email Log Search delivery records are available for 30 days; Gmail log events are retained for six months.
3. BigQuery cost depends on data processed. A LIMIT clause does not generally cap bytes read.
4. Partition filters, selected columns, dry runs and maximumBytesBilled can reduce or bound query cost.

PunchOp proposed response

1. Start from the incident and identify the smallest relevant evidence source.
2. Generate bounded queries with explicit columns and time partitions.
3. Show the retention, permission and edition constraints before a search is attempted.
4. Separate “no matching event” from “this source cannot contain the event.”

Submit a similar incident →

All pain points →