Hi Steve,
In those cases where [nimts] and [created] are not the same, what happens is the following: The [nimts] will always match the [time].nas_transaction_log of the first instance and the time_origin.nas_alarms. The [created] instead can be updated after in the life of the alarm; for example if the alarm is cleared but not acknowledged (see all updated descriptions below!)
NAS_TRANSACTION_LOG
[time] This value corresponds to the date and time each instance of the alarm was originated. In the first occurrence of the alarm this field correspond to the [time_origin].nas_alarms
[nimts] corresponds to time_origin.nas_alarms
NAS_TRANSACTION_SUMMARY
[created] Normally the created field corresponds to the date and time of the first occurrence of the alarm (so it corresponds to the [time_origin].nas_alarms and [time].transaction_log of the first occurrence of the alarm)*
*If the NAS is configured to NOT "Accept automatic 'acknowledgement' of alarm, the Created field might not correspond to the [time_origin].nas_alarms. When "Accept automatic 'acknowledgement' is not active, the level 0 alarms (Clear alarms) do not close the alarm. When the "Accept automatic 'acknowledgement' option is ticked (it is by Default when a clear alarm arrives it automatically acknowledges the alarm. Any new occurrence after being cleared and acknowledge will be a new alarm (new nimd).
When the "Accept automatic 'aknowledgement' option is NOT ticked, a clear alarm is treated as a normal alarm: it will have the same nimid. In this case when a clear alarm comes in it doesn't close the alarm and it resets a the [created].nas_transaction_log. In this cases the [created].nas_transaction_log does not correspond to the time_origin].nas_alarms but it would match instead the [time].transaction_log of the first occurence right after the clear alarm.
[closed] This is only filled when the alarm is acknowledged and corresponds to the time when the alarm is acknowledge.
[time] This corresponds to the date and time of the last occurrence of the alarm (And it is the same value as the [time] field of the last occurrence of the transaction_log)
[nimts] This is the date and time of the first occurrence of the alarm. (same as [time_origin].nas_alarms)
IM - ALARMS DETAILS
[Time Received] Corresponds to the "time" field in the nas_transaction_summary
[Time Origin] Corresponds to the "time_origin" of the NAS_ALARMS and "created" field in the nas_transaction_summary.
[Time Arrival] Corresponds to the "time_arrival" field of the NAS_ALARMS (which is the time stamp of when the alarms was actually received by the nas)
IM - ALARM HISTORY
[Time Created] Corresponds to the [created] .nas_transaction_summary.
[Time] Corresponds to the [time] .nas_transaction_summary.