Insert vs Event Time

Insert versus event time is the difference between when the action actually happened (event time) and when the server received and stored it (insert time).

Ideally the two are nearly identical, but wherever there is delay they separate: an offline event sent hours later, batching that arrives with deliberate delay, or a historical import whose event time is last year but was inserted today. Choosing which axis to read the report on changes interpretation: behavioral and trend analysis should be on event time because it cares about 'when the user did something,' while live monitoring and operational debts make sense on insert time because they concern 'when the data arrived.' The common trap is reading a one-day spike or dip as real behavior when it is only a batch of late events arriving together with today's insert time. So before drawing any conclusion from a daily anomaly, you must know which time the chart is built on.