Abstract: A method is disclosed for analyzing computer events recorded in a plurality of computer datasets. The method includes a read module configured to access chronicle records in two datasets, an extraction module configured to extract a timestamp from each chronicle record, a generation module configured to generate a chronicle time indicator for each chronicle record based on the extracted timestamp, and a placement module configured to place the generated chronicle time indicator into the associated chronicle record. Typically, chronicle records in a first chronicle record have records with desired timestamp characteristics while chronicle records in a second dataset have chronicle records with incompatible timestamp characteristics. The method generates the chronicle time indicator to be compatible with desired timestamp characteristics of the first dataset and place the generated chronicle time indicator in each incompatible chronicle record.