Public search query: how to reconstruct an incident timeline from logs after the fact