A system for determining a cause of an incident analyzes one or more change records based on text analytics using a dictionary and rules for the analysis in order to generate an index of analyzed data that represents the one or more change records. The change records each include a change and corresponding time frame for occurrence of the change. Information from a request is applied to the index of analyzed data to determine one or more candidate causes for the incident and the corresponding time frame for occurrence of the change. A time associated with the request is correlated with the corresponding time frame for occurrence of the change to identify the one or more candidate causes in the one or more change records as causes for the incident. Embodiments of the present invention further include a method and computer program product for determining causes of an incident.