Which clock created the timestamp?¶

Identify the originating device or service clock for every material timestamp. Logs in one dataset can legitimately contain values created by source, server, collector and display systems.

Clocks and stages accumulate¶

A laptop can use local time, a cloud service UTC, a collector its server clock and a dashboard a converted display. Drift, manual change, restart, virtualisation and failed synchronisation affect each differently.

Establish clock history and relationships¶

Map field to originating component and determine whether time was added at event, collection, ingestion or display. Preserve zone and synchronisation configuration, error, restart and manual-change records where proportionate.

Do not force records into a single sequence until offsets and uncertainty are understood and documented.