> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tryflare.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Running an Analysis

> How to trigger an analysis from a connector or file upload

# Running an Analysis

There are two ways to run an analysis in Flare: **live fetch** from a connected cloud provider, or **file upload** from any source.

## From a connected GCP connector

If you've already [connected GCP](/connectors/gcp), this is the fastest path.

1. Go to **Analyses > New Analysis** (or click **Run analysis** from the Connectors page)
2. **Name your analysis** - a descriptive name helps when reviewing history later (e.g., "Prod audit - May 29")
3. **Select GCP Audit Logs** as the source
4. **Choose "Fetch live"** - this appears when you have an active GCP connector
5. **Enter your GCP Project ID** - the project you want to scan
6. **Select a time window:**

| Window   | Best for                                           |
| -------- | -------------------------------------------------- |
| Last 1h  | Quick check after a deploy or incident             |
| Last 6h  | Morning review of overnight activity               |
| Last 24h | Daily security review (recommended starting point) |
| Last 7d  | Weekly deep scan                                   |
| Last 30d | Comprehensive audit                                |

<Note>
  Larger time windows (7d, 30d) may take 30-60 seconds to fetch and could hit GCP API rate limits. Start with 24h.
</Note>

7. Click **Fetch & Analyze**

Flare fetches up to 1,000 of the most recent audit log entries in your selected window, then runs the analysis.

## From a file upload

If you don't have a connector set up, or want to analyze logs from a different source:

1. Go to **Analyses > New Analysis**
2. **Name your analysis**
3. **Select the log source** (GCP Audit Logs, or match your log origin)
4. **Drop or browse** for your log file (JSON, NDJSON, CSV, or plain text, up to 2 MB)
5. Optionally set **Project ID** and **Time Window** for context
6. Click **Run Analysis**

See [File Upload](/connectors/file-upload) for format details and preparation tips.

## During analysis

While Flare is running, you'll see a loading state with a progress message. Analysis typically takes:

* **15-30 seconds** for small log sets (under 200 entries)
* **30-60 seconds** for larger sets (200-1,000 entries)
* **1-2 minutes** for very large sets that require multiple analysis passes

You can navigate away - the analysis runs in the background. Check the **Analyses** page to see when it completes.

## Daily limit

During the open beta, each account can run **10 analyses per day**. The counter resets at midnight UTC.

You can check your remaining quota at the top of the New Analysis page, which shows "X of 10 analyses today."

<Tip>
  [Scheduled runs](/scheduled-runs) bypass the daily limit - they're designed for automated, recurring analysis without eating into your manual quota.
</Tip>

## Analysis history

All your analyses are saved in **Analyses** in the sidebar. Each entry shows:

* Analysis name and source
* When it was run
* Status (Complete, Analyzing, or Failed)
* Number of anomalies found (or "Clean" if zero)

Click any analysis to view the full results. You can delete analyses you no longer need.