Analytics Detective: Quick Start Guide

Step-by-step instructions on setting up Analytics Detective data connector in Looker Studio to audit your GA4 export tables in BigQuery.

This guide covers essential setup steps, including creating a GCP Service Account, granting permissions, and configuring the connector.

To start using Analytics Detective, follow these 3 steps:

1. Create a Service Account in you Google Cloud Platform
2. Assign Permissions to this Service Account
3. Configure the Data Connector in Looker Studio

Step 1: Create a Service Account in Google Cloud Platform

To enable secure processing of to your GA4 data in BigQuery in your own Google Cloud Platform, you’ll first need to create and configure a service account. This service account will handle data requests, ensuring the whole process stays within your project and align with your data governance policies.

Prerequisites:

You need a certain level of IAM permission in GCP to create a service account:

• IAM Service Account Creator (roles/iam.serviceAccountCreator): Allows you to create service accounts.
• Project IAM Admin (roles/resourcemanager.projectIamAdmin): Required to assign roles to the service account, enabling the service account access to BigQuery datasets and job execution.
• Environment: Ensure you have access to the BigQuery project where the GA4 data is stored.

Instructions:

1. Log into Google Cloud Console (https://console.cloud.google.com)
2. Navigate to IAM & Admin > Service Accounts.
3. Create a Service Account:
• Click Create Service Account and specify a Name (e.g., Analytics_Detective).
• Add a Description (e.g., "Service account for Analytics Detective connector").
4. Assign BigQuery Permissions to this Service Account:
• In the Grant this service account access to the project step, assign the following roles:
• BigQuery Data Editor (roles/bigquery.dataEditor): Enables the service account to read GA4 data and create datasets and tables required for storing audit results.
• Alternatively, you can grant BigQuery Data Viewer (roles/bigquery.dataViewer) which only enables the service account to read GA4 data without storing audit results, this is sufficient if you’re only using the Lite version of Analytics detective.
• BigQuery Job User (roles/bigquery.jobUser): Allows the service account to run query jobs in BigQuery.
• Click Continue, then Done to finalize the service account setup.
5. Generate a JSON Key:
• Once the service account is created, go to Keys within the service account settings.
• Click Add Key > Create new key, choose JSON, and download the JSON file.

FAQ:

• Why are BigQuery Data Editor and BigQuery Job User necessary?
• These roles allow the service account to read your GA4 export table from BigQuery and execute necessary queries to audit the data within the table.
• Why is JSON key security important?
• The JSON file contains sensitive information. If shared, it can grant unauthorized access to your project.

Step 2: Getting your license key

To start using Analytics Detective, you’ll need a license key.

To obtain a license key, simply visit this link and enter the email address you’d like the license key to be sent to, and you’ll receive it immediately in your inbox.

Step 3: Configure the Data Connector in Looker Studio

Configure the Analytics Detective connector in Looker Studio:

1. Access Connector:
• Open the connector using this link .
2. Authorize Connector:
• Sign in with your Google account to authorize the connector.

🔒 The connector does not store any credentials; it uses the service account JSON key solely to generate temporary access tokens that expire after each use. Read more here: https://cloud.google.com/bigquery/docs/use-service-accounts#:~:text=A service account can run,see Update data transfer credentials.

3. Connector Configuration:
• Service Account JSON Key: Paste the full contents of the downloaded JSON key from Step 1.
• GA4 Events Table ID: Enter the full table ID for your GA4 export in the format project.dataset.table_id_*.
• License Key: Paste your license key that you have received via email to activate your connector.
• Select Use Report Template when prompted during the connector setup in Looker Studio. This option loads a custom dashboard, pre-configured with graphics, metrics, and issue explanations.
• Template Customization: You can further customize the Looker Studio report by modifying colors, fonts, logos, and adding organization-specific branding elements to ensure the report aligns with your visual identity.
4. Initiate A New Audit:
• Once your data source is created, click Create Report to initiate your first audit. This will audit the data in your GA4 export table for the last month.

5. Performing New Audits: To perform a new audit, simply choose a new date range. By doing so, the Analytics Detective data connector will perform a new audit on the GA4 data for the newly specified date range.

FAQ:

• Does the connector store my service account credentials?
• No. The service account JSON is only stored in your data source configuration and is used only temporarily to generate a token, which is discarded after the each use.
• Can I audit intraday GA4 data?
• This feature is on the roadmap for the future versions of Analytics Detective.

Step 4: Set Up Cost Monitoring (optional)

1. Review Service Account Usage
⚠️

⚠️ Important: Ensure the service account used for the Analytics Detective connector is not shared with other jobs. This will help isolate costs directly related to the connector.

2. Add Required Permissions
• Ensure your personal Google account (not the service account) has BigQuery Resource Viewer roles/bigquery.resourceViewer access. This permission is necessary to view the cost metrics in the dashboard.
3. Edit the Cost Monitoring Query

• In Looker Studio dashboard toolbar, click +Add Data, then Choose BigQuery, then CUSTOM QUERY, and finally select the GCP project in which your GA4 export table is located.
• In Edit Custom Query box, copy and paste the following SQL query:
Copy

sql
Copy code
WITH
  QueryCosts AS (
  SELECT
    labels.key,
    labels.value,
    DATE(creation_time, "UTC") AS creation_date,
    job_id,
    ROUND(total_bytes_processed / (1024*1024*1024), 2) AS bytes_processed_in_gb,
    IF
      (cache_hit != TRUE, ROUND(total_bytes_processed * (6.25 / (1024*1024*1024*1024)), 4), 0) AS cost_in_dollar,
    project_id,
    user_email
  FROM
    `region-eu`.INFORMATION_SCHEMA.JOBS_BY_PROJECT,  -- Replace `region-eu` with your BigQuery region
    UNNEST(labels) AS labels
  WHERE
    DATE(creation_time) BETWEEN DATE_SUB(CURRENT_DATE(), INTERVAL 8 DAY)
    AND CURRENT_DATE()
    AND job_type = 'QUERY'
    AND user_email = '<<YOUR SERVICE ACCOUNT EMAIL>>'  -- Replace with your service account email
 )
SELECT
  creation_date,
  SUM(bytes_processed_in_gb) AS bytes,
  SUM(cost_in_dollar) AS cost
FROM
  QueryCosts
GROUP BY
  creation_date;

• Update the custom SQL query with your specific details, including the service account email and the BigQuery region (e.g., region-eu), then click connect to create your cost monitoring data source.
• In the Looker Studio dashboard, locate the Cost Monitoring page, select the chart in the middle of the report canvas, and assign the cost monitoring data source to the chart.
• Verify Cost Monitoring Chart
• After updating the query, save the changes and refresh the Looker Studio dashboard.
• The Cost Monitoring chart will display data processing costs over the last 8 days, showing the total data processed (in GB) and the associated costs per day.

Step 5: Getting help

We provide support for Analytics Detective in a dedicated space in Looker Studio Masterclass community.

Please use this link to join the community and access Analytics Detective space. There you can get in touch with us, get help with any issues you might have, discuss your usage, and request features to be considered in the roadmap.