I'm analyzing elapsed times for jobs, using the data in the several QHST* files on a system. I copy the first record for the CPF1124 & CPF1164 messages into one file, and the third record for the CPF1164 message into another file. I take the first 8 bytes and convert to a timestamp - that value is the join ID for the rows for a given message, but it is the MI TOD for the time the message was sent, so it seems it is usable for start and end time for the job.Well, you've thrown a half dozen variables into the mix, including how you copy records out of the history file and how you do your conversions. But assuming everything is copacetic, then what you're describing is having multiple CPF1164s for one CPF1124. That's highly unlikely so what I suggest you do is dump the the timestamps of the multiples, then use that to go back against the QHST file to find the matching messages. Print the actual messages from the log which have produced the single CPF1124 and the multiple CPF1164s.
What I see is that some jobs, mostly server jobs, have multiple end times for the same start time, same job. Here is an example of counts for grouping by job name, job number, and start time.
PCDMAA 863696 2008-03-03-22.214.171.1241112 7
QTCPIP 743863 2008-03-02-10.23.47.283288 17
QSQSRVR 458037 2008-02-28-126.96.36.1996880 2
The first job is an interactive job - the others are server things.
So what's up? Fortunately, this behavior does not affect the stuff I'm analyzing, just curious.