How do I trace one inspection attempt across systems?

@HassanBrown0878 Found it. I can split our Python log into two sessions. Still no attempt match for that PLC acknowledgement, though.

Keep source order, label the sessions and leave that acknowledgement unassigned. Comparing the timestamps alongside them should establish the combined order.

Those clocks disagree. Why would putting their timestamps beside the sessions establish an order across systems without an offset or matching exchange?

@JamieChan1078 You're right; I went too far. Timestamps suggest matches. Keep source order and mark cross-system links uncertain unless evidence supports them.

@HassanBrown0878 I'll leave it unassigned. A tidy timeline would be nice, but the nearest timestamp would still be a guess.

I had a clock adjustment make a merged incident view look plausible on my setup. The original per-source order was what let us correct the interpretation.

Would monotonic time fix it? Or only inside one process?

Use monotonic time for durations within a running process. It doesn't supply a shared clock across machines or restarts; keep session identity and wall-clock reference alongside it.

@HassanBrown0878 Stable job ID, separate attempt ID for each try? Is that what our reused label is missing?

Yes. Job for the work, attempt for each try. Record both with your event source and session.

Can your PLC exchange carry that identity? Python IDs won't label another system's records by magic.

I can't see a correlation field in our export. I'll need the interface owner's input, and that won't retroactively identify the entries I already have.

Your view can still organize the application events correctly. Mark the missing cross-system identity explicitly so readers know where the link stops.

@HassanBrown0878 What replaces started and done? I'd have picked those too

@HassanBennett0704 Request recorded, acknowledgement received, completion reported, each with its source. Timeout means your wait ended; it doesn't establish the robot's final result.

This resolves how I'll present the incident: separate source sequences, application sessions identified, and the unmatched acknowledgement left uncertain. I'm not claiming that establishes the job's final outcome.

That gives readers an honest incident view without making the unknown result look settled.