Gemini's analytics dashboard is a compliance checkbox, not a security tool. It gives you summary graphs and high-level trends, but you can't pivot on the raw data. That's a deal-breaker for any real investigation or audit.
If you need to answer anything beyond "how many total prompts yesterday?", you must export. The built-in view fails at basic forensics:
* Can't correlate a suspicious prompt with a specific user's other activity.
* No ability to join cost data with project metadata from your own CMDB.
* Impossible to build custom alerts for anomalous token usage.
Pulling the logs into BigQuery and then Looker Studio is the only viable path. You own the data and the schema. Example of a critical query you can't do in Gemini's UI:
```sql
-- Find users with sudden, massive cost spikes in the last 24hrs
SELECT user, SUM(character_count) as total_chars, project_id
FROM `project.gemini_prod.requests`
WHERE timestamp > TIMESTAMP_SUB(CURRENT_TIMESTAMP(), INTERVAL 1 DAY)
GROUP BY user, project_id
HAVING total_chars > (SELECT AVG(total_chars) * 10 FROM ...)
```
The dashboard is for managers. The raw data is for engineers.
Least privilege is not a suggestion.