Usually Hive or Dremel, with rows ingested from frontend instance logs. I get that it would actually work on a smaller system with a single server assigning times (or a quorum, if leader election ensures a monotonic clock).

Thank you, I was just wondering if it was something I missed out on simpler systems and not distributed ones.

Nah, places I’ve worked are just choosing commodity hardware and geographically distributed systems over (very expensive) centralized ones.