Log analysis needs two things. One - as @ITWhisperer already mentioned - is the logs themselves. You must have the data to analyse. You can't analyse something you don't have.
Another important thing is the goal of your analysis - what you want to get from your logs. A question you want answered using the data you have. You don't just "analyse logs" for fun. You want the logs to tell you, for example - if anyone tried to log in to your network and failed. How many such attempts were made? Were someone persistent in their attempts or were there just "random" occurrences? Or you can check performance data - what connection quality your clients had. What bandwidth did they use. And so on.
Of course to answer such questions you need a relevant set of data for each use case. You can't typically tell much about security from performance data and vice versa. (Sometimes anomalies in one type of data can be a hint of something happening elsewhere but that's a much more advanced topic and for now don't bother with it).
