Chainsaw: the hit time is not when you hunted

The row has the event time

A hit line can include a timestamp taken from the event. That is when the log says the event occurred. It is not the clock on the analysis machine, and it is not the moment the hunt command returned.

If the timestamp cell is empty, write “event time not on this row.” Do not fill it with the time you started the hunt.

The hunt time is the job

Your notes or the console can say when the hunt started. That is when the tool read the logs. Hits inside an old log still carry old timestamps. A hunt on Thursday does not move Wednesday’s events to Thursday.

The window you passed, if you used one, limits which hits return. The timestamp on a hit that did return is still the event time, not the window’s start.

What to file

File the hit timestamp as the event time and the hunt start as the job time. Label them. A sentence about when the event happened uses the hit. A sentence about when you searched uses the job.

Worked case: a Thursday hunt and an October event

The hunt for package LAB-02 was started at 2026-11-04T09:00:00Z. A hit row shows timestamp 2026-10-28T09:12:44Z. A draft says the event occurred on 4 November because that is when Chainsaw was run.

The note quotes 28 October as the event time on the row and 4 November as the hunt. The event is not redated. The hunt time stays the job.

Snippet

hunt started: 2026-11-04T09:00:00Z
hit timestamp: 2026-10-28T09:12:44Z
write: event time is the hit
job time is the hunt
not: the event was on 4 November

Diagram

The event clock and the job clock

Running the hunt does not change the hit’s timestamp.

Hit timestamp

Is. The time on that event row

Use. When you say when the event occurred

Missing. Say the cell was empty

Hunt time

Is. When you ran the tool

Use. When you say when you searched

Does not. Replace the hit timestamp

Check yourself

1. A hit is timestamped 28 October and the hunt ran on 4 November. When did the event occur, according to the row?

2. What is the November time in that note?

3. The hit has no timestamp cell. What do you use?