How do I compare timestamps across files?

Here are the 3 best ways to compare timestamps in Power BI:

1. The "Master Timeline" (Overlay Method)

This is the most common way to see if events in different files happened at the same time.

• Visual: Line Chart or Area Chart.
• X-Axis: Use your parsed Timestamp column. (Ensure it is set to "Date/Time" type, not "Date/Time Hierarchy").
• Legend: Use the Source.Name or Log Family (IDF, EPS, IFS).
• Values: Count of Rows.
• The Result: You will see multiple lines on one graph. If the "EPS" line drops to zero at the exact same time the "IDF" line spikes with errors, you have proven that a service heartbeat failure caused the scan to crash.

2. The "Side-by-Side" Matrix (Correlation Method)

If you need to see the exact sequence of events across files, use a Matrix.

• Rows: Timestamp (set to show seconds).
• Columns: Source.Name or Log Family.
• Values: First(Message) — Note: Use "First" or "Last" so it displays the text.
• The Result: This creates a "Vertical Timeline." You can scroll down and see:
• • 10:01:05 AM: EPS says "Heartbeat Sent" | IDF says "Scanning File X"
  • 10:01:06 AM: EPS says "Connection Lost" | IDF says "Waiting for Service"
  • 10:01:07 AM: EPS is blank | IDF says "ERROR: Service Unavailable"

3. The "Time Delta" Calculation (Advanced)

If you want to know exactly how many seconds passed between an event in File A and an event in File B, you use a DAX Calculated Column.

Example Scenario: How long after the EPS service starts does the IDF scan actually begin?

1. Create a Measure to find the first "Service Started" time in EPS.
2. Create a Measure to find the first "Scan Started" time in IDF.
3. The Formula:

TimeGap = DATEDIFF([EPS_Start], [IDF_Start], SECOND)

• Why this is useful: It helps you detect "Lag." If the gap is usually 5 seconds but suddenly becomes 300 seconds, you have a resource contention or startup delay issue.

Critical Technical Tip: Timezone Alignment

Spirion Agents often log in Local Time, but some cloud components log in UTC. When comparing timestamps across files:

• Check the Header: Look at the first few lines of the logs to see if they specify a timezone.
• The Fix: In Power Query, use the "Add Time Zone" or "Convert to UTC" transformation. If you don't align them, your charts will show events happening hours apart when they actually happened simultaneously.

Summary of Comparison Techniques

Summary: To compare timestamps, overlay them on a Line Chart to see visual correlations, or use a Matrix Table to read the chronological sequence of messages across different log families. Always ensure your Timezones are aligned before comparing.