Hi. If you see how the answer in https://answers.splunk.com/answers/584114/how-to-identify-pages-with-404-page-not-found-stat.html mentions getting at the fields, you would find the field associated with "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" So search around the time that got that above event and then add <your initial search>| table * Scroll around and you will find the one that has "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" If you don't have fields then you will need to add props.conf to identify the fields. There's lots of Splunk documentation on how to do that. If you have control over what is creating the web logs, I highly recommend using field/value pairs instead of positional fields. It makes life so much easier if your logs have status=200 bytes=10371 etc and Splunk pulls these fields out for you. ... View more