Incident Timeline Reconstructor

Use during or right after an incident, when logs from several services need to be interleaved.

Here are raw logs from the last hour across [services]: [paste]. Reconstruct a timeline of what happened, in order, and flag the first anomalous event.

Anything in square brackets is meant to be replaced. The builder turns those into fields you can type into.