Once you can expose structured information you will want to know how much of each structure you have. Do the counts make sense? Are things in proportion?
Where there are duplicates, count them.
cat unknown | sort | uniq -c | sort -n
Where things appear in spurts, plot them.
cat /var/log/httpd/access_log |\ perl -e ' while () { for(1..100) { print "|" if (<> =~ /googlebot/) } print "\n" }' | \ less