Trouble with the Google Workspace add-on user usage logs

[CharlesGFI]

Wondering if anyone can provide guidance on some issues I'm having with my input using the userUsageReport endpoint in the Google Workspace add-on. I'm encountering a couple of different things.

The first one seems to only occur on even numbered days (over the past week, it's happened on the 2nd, 4th, 6th and 8th, but not the 3rd, 5th, 7th or today). I see an error this error in the log:

"Usage Report Error" Exception raised while ingesting data for usage report: Could not retrieve data for Usage Report. Reason: No dates in the interval..

In the configuration for the input, I've left the optional Start Date empty to accept the default of 30 days, and that seems to be the only place where I have input on the dates used by the input, so I'm not sure what to do about "No dates in the interval" here.

The second issue is that on the dates that data does seem to be ingested, I am not seeing it in the index. A sample in the log from the April 7th run:

2026-04-07 01:34:07,144 log_level=INFO pid=1229663 tid=MainThread file=gws_usage_report.py:stream_events:186 | events ingested: 558
2026-04-07 01:34:07,144 log_level=INFO pid=1229663 tid=MainThread file=log.py:log_event:230 | action=events_ingested modular_input_name=gws_usage_report://UserUsage sourcetype_ingested=gws:usage_reports:user n_events=558 event_input=UserUsage event_index=google_workspace

When I search the google_workspace index, there is no data for the sourcetype for any timeframe I select (just using index="google_workspace" in the query), even though the log seems to indicate that I should have 558 events on the 7th. Do you have any guidance for debugging this? I've just changed the log level to DEBUG to see if anything is revealed that way, but I'd appreciate any other suggestions you may have.

[kknairr · Accepted solution]

@CharlesGFI For the first issue, can you explicitly configure Start Date in the input to guarantee valid ranges. May be that would help to solve this issue.

Ref:

Configure the Splunk Add-on for Google Workspace - Splunk Add-on for Google Workspace

For the second issue, see section - No events appearing in the Splunk platform on the troubleshooting guide. 

Troubleshoot the Splunk Add-on for Google Workspace - Splunk Add-on for Google Workspace

Hope that helps. 🙂

>>

If this post addressed your question, you can:

• Give it karma to show appreciation 👍
• Mark it as the solution if it solved your issue ✔️ 
• Add a comment if you’d like more details ✏️

Acknowledging helpful answers keeps the community strong and motivates contributors to continue sharing their expertise.

>>

 

[CharlesGFI]

Thanks @kknairr. I removed the input and recreated it, explicitly setting the date, and also edited the service account config to add the JSON again just to make sure that was correct, and events are now appearing in the index. Thanks for the help!

[kknairr]

@CharlesGFI Perfect, glad that it helped. Thanks.