Various technologies and techniques are disclosed that indirectly correlate event streams on multiple computers. Event details are retrieved for multiple data streams from each of the computers. The event details include a task identifier and ordering identifier for each event in the data streams on each computer. The task identifiers and ordering identifiers are unique to each computer, allowing the events to be correlated with the other events on the same computer only. A uniqueness token is retrieved that provides direct correlation information about how a particular event on the first computer is directly correlated to a particular event on the second computer. An indirect event stream correlation process uses the directly correlated information in combination with the respective task identifiers and respective ordering identifiers from the first and second computers to establish an ordering between the events on the first computer and the events on the second computer.