Preserve each original log and establish the order within each application run first. Do you have startup entries, counters or unique attempt references that can link events without guessing a clock offset?
Ask controls whether the original PLC capture contains more fields than the exported list. There may be a request sequence or another retained value that was not selected for export.
Will the next version record a unique attempt identity on both sides? That would improve future reconstruction, while leaving this old event explicitly unresolved.