Found it. I can split our Python log into two sessions. Still no attempt match for that PLC acknowledgement, though.

Start with the session split and each source's own ordering, leaving that acknowledgement unassigned. The timestamps beside those entries should establish a combined sequence.

Those clocks disagree. No offset or causal link, no established combined order.

@ChloeChen1179 You're right to challenge that. The timestamps can suggest matches, not prove them. Keep source order intact and label cross-system links uncertain unless there's supporting evidence.

I'll keep that acknowledgement unassigned. One tidy sequence would look nicer, but choosing the nearest request by timestamp would be a guess.

I had a clock adjustment make a merged incident view look plausible on my setup. The original per-source order was what let us correct the interpretation.

Can monotonic timestamps fix the clock issue across these systems, or are they only comparable within a process?

Use monotonic time for durations within a running process. It doesn't supply a shared clock across machines or restarts; keep session identity and wall-clock reference alongside it.

Stable job ID, separate attempt ID for each try? Is that what our reused label is missing?

That's the useful split. A job ties the work together; an attempt distinguishes each try. Record both with the event source and session.

Does the documented PLC interface support a correlation value? Application identifiers alone won't create matching identifiers in another system's records.

@ChloeChen1179 None in our export. I'll ask the interface owner what's supported, but that won't retroactively identify the PLC entries I've.

Your view can still organize the application events correctly. Mark the missing cross-system identity explicitly so readers know where the link stops.

@BrunoAbbott0017 What replaces started and done? I'd have picked those too.

Use labels such as request recorded, acknowledgement received and completion reported, with the source attached. A wait timing out doesn't establish what the robot ultimately did.

I can distinguish our application sessions, but the acknowledgement still lacks a defensible match. The incident is clearer without being fully reconstructed.

@NadiaBell0639 Clearer sessions help, and you're right that they don't supply the missing acknowledgement link.