Data retention and lag times

You may find that your Admin console reports and audit logs are not fully populated with the latest data.

Keep in mind reports do not reflect real-time data, and some reports may take longer to display updated information.

Lag times

The lag times in this table reflect how long it takes before collected data tied to specific Admin console reports and audit logs is available to view.

Refer link for more details -

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    

Item name	Report name	Lag time
Highlights
Gmail	Gmail report	1–3 days
Drive	Drive report	2–6 days
Hangouts	Hangouts report	1–3 days
Google+	Google+ report	1–3 days
Calendar	Calendar report	1–3 days
Document Link Shared Status	Drive report	2–6 days
Security
External Link Shared Files	Drive report	2–6 days
External Link Shared Files	Security report	1–3 days
Less Secure Apps Access	Security report	1–3 days
2-Step Verification Enrollment	2SV report	1–3 days
Aggregate reports
Accounts	Accounts report	1–3 days
Gmail	Gmail report	1–3 days
Drive	Drive report	2–6 days
Google+	Google+ report	1–3 days
Mobile	Mobile report	1–3 days
Apps usage activity
Files owned	Drive report	2–6 days
Total Emails	Gmail report	1–3 days
Total Storage Used (MB)	Quota report	1–3 days
Audit
Admin	Admin audit	near real time (couple of minutes)
Login	Login audit	tens of minutes (can also go up to a couple of hours)
Drive	Drive audit	near real time (couple of minutes)
Calendar	Calendar audit	tens of minutes (can also go up to a couple of hours)
Mobile devices	Mobile audit	near real time (couple of minutes), up to 4 hours, if updated at next sync.
SAML	SAML audit	near real time (couple of minutes), up to 3 hours, if updated at next sync.
Token	Token audit	a couple of hours
Groups	Groups audit	tens of minutes (can also go up to a couple of hours)
Email log search	Email audit	near real time (couple of minutes)