Web access logs - how to identify the first hit of the visit, and extract certain fields?

[lepinepd]

Trying to create some basic web analytics reports, like top referrers, top landing pages, etc. These things require identifying the first hit of the visit. Have been playing with transaction to group the events into a "session". But then not getting correct results when trying "streamstats first(req_time) as first_hit by user".

Anybody cracked this fundamental issue of finding the first/last hit of a web visit in access logs?

[charris_splunk]

Check out eventstats and the first() function:
http://docs.splunk.com/Documentation/Splunk/6.1.3/SearchReference/eventstats

I think you're after something like this:

sourcetype=access* | eventstats dc(session_id) as Visits | stats count as Views, first(Visits) as Visits by uri

If you don't have a session_id logged, consider using the clientip a mashup of client_ip and useragent :

sourcetype=access* | eval uid = clientip + useragent | eventstats dc(uid) as Visits | stats count as Views, first(Visits) as Visits by uri