I'm trying to query the event log and iis logs at the same time. I would like to correlate application pool crashes/errors with request from the iis logs. I have my two working examples below but I’m not sure how to combine them. Any help would be greatly appreciated.
sourcetype=iis host=Server1
source="WinEventLog:*" index="wineventlog" host=Server1
I think what you are trying to do would be something like this:
(sourcetype=iis host=Server1) OR (source="WinEventLog:*" index="wineventlog" host=Server1)
This would give you the results from either search.
I think what you are trying to do would be something like this:
(sourcetype=iis host=Server1) OR (source="WinEventLog:*" index="wineventlog" host=Server1)
This would give you the results from either search.
That worked. Thanks!