Check out eventstats and the first() function: http://docs.splunk.com/Documentation/Splunk/6.1.3/SearchReference/eventstats I think you're after something like this: sourcetype=access* | eventstats dc(session_id) as Visits | stats count as Views, first(Visits) as Visits by uri If you don't have a session_id logged, consider using the clientip a mashup of client_ip and useragent : sourcetype=access* | eval uid = clientip + useragent | eventstats dc(uid) as Visits | stats count as Views, first(Visits) as Visits by uri ... View more

Hi Charris, Please specific the saved search name to create the u_host(Domain). Thanks in Advance! ... View more

Thanks Glenn: Great!!! Works with me. ... View more

I've created an Splunk R app. It's really in a very early status so don't use it in production environment. Description from http://apps.splunk.com/app/1735/: This app provides a new Splunk search language command 'r' that allows passing data from Splunk to the R-Engine for calculation and then passing results back to Splunk for further computation or visualization. The app is open source: https://github.com/rfsp/r. Please feel free to contribute. Please provide feedback, questions and suggestions! ... View more