how to correlate Application log and Server logs

[aaru]

Hi,

We are trying to create a chart containing application error logs and the logs of the corresponding server to relate application issues with the server behaviour.

Kindly advise if any existing apps are available / steps to create a custom chart.

[yannK]

If you want to find an event in the first log, then extract the timerange of the crash event. And use it to retrieve the system logs around the same time period,

You can look at those methods :
http://answers.splunk.com/answers/75204/create-time-range-from-times-gleaned-from-one-search-to-perf...

Or use a search on both logs of the same host at the same time, and display the cpu/mem timechart and a count of crash events in a timechart.

pseudo search :
(sourcetype=application AND crash ) OR ( sourcetype=system cpu OR mem) | eval crash_event=if(sourcetype="application",1,0) | timechart avg(cpu) avg(mem) sum(crash_event)

[piebob]

note: there is a bug in Splunk Answers that doesn't bring the app tag across when you click 'ask a question' on the app page on apps.splunk.com, which is why this question has less context than expected :).

[lukejadamec]

One way to start an investigation like this is to search the time frame prior to the failure for every log for that server. If you use a time span long enough you might see spikes or gaps in activity.

The easiest way to corelate Application and Security logs is by time. For very short time spans I find a table with _time,Message handy because it basically gives you a timeline of events.

[aaru]

"Here's the scenario: we have a business application and it has crashed due to unknown issues. we want to check the application generated error logs such as table data / log files against the server data such as CPU usage by process, Memory usage by process, Disk I/O usage by process during the time of crash to find a root cause of the issue."

Please advise on the same

[Ayn]

This question is WAY too generic for us to be able to offer you any useful advice. What server logs? What application logs? How would you want to correlate them? Exactly what should the chart show? In what sense would it be custom? Etc, etc, etc...