Not sure your question really falls into the area of regex. I'm going to make some assumptions: You are using Apache or similar webserver that logs in the NCSA-style "combined" log format You have configured Splunk to index those combined logs and they are being indexed with the proper sourcetype recognition and field extraction is happening as it should Assuming both of those are true, then what you want should be a simple search in Splunk, something like: sourcetype=access_combined | timechart dc(src_ip) If my assumptions are off, you're going to have to clarify some so we can tell where you are. ... View more