What is timestamp precision?¶

Timestamp precision is the level of detail with which a time is recorded.

A timestamp may be precise only to the day, minute or second, or it may include milliseconds or smaller units.

Avoid this assumption: That a more detailed timestamp is automatically more accurate. It is not.

Precision describes how many time units are displayed or stored. Accuracy describes how close the recorded time is to the true time. A system can record milliseconds from a clock that is several minutes wrong.

Precision matters when several events occur close together. If a log records only whole seconds, ten events within the same second may all show the same time. Their displayed order may come from record sequence, not from a measurable difference in event time.

Exports and dashboards may reduce precision. A source record may contain milliseconds while a spreadsheet displays only seconds. Another platform may round or truncate the value.

Investigators should preserve the original timestamp format and identify its precision. Ask whether additional digits exist in the source data and whether the display or export removed them.

Do not invent an order between events that share the same recorded time unless another field supports it. Sequence numbers, event IDs, request IDs or source ordering may help.

Equally, do not describe an event as occurring at an exact millisecond merely because that value is present. The system’s clock and event-generation process must support that level of certainty.

Operational takeaway¶

Timestamp precision shows the smallest unit recorded, not the reliability of the clock, so investigators must separate detail from accuracy and avoid overstating sequence where events share the same recorded time.