Actually, you don't need to edit config files to do this. In the Splunk UI, under Settings->Fields you will see an entry for "Calculated fields". If you create the same definition that you put into your search there, assign it to your sourcetype in question and share it globally, the field will be automatically calculated whenever you search for that sourcetype. ... View more

Check out eventstats and the first() function: http://docs.splunk.com/Documentation/Splunk/6.1.3/SearchReference/eventstats I think you're after something like this: sourcetype=access* | eventstats dc(session_id) as Visits | stats count as Views, first(Visits) as Visits by uri If you don't have a session_id logged, consider using the clientip a mashup of client_ip and useragent : sourcetype=access* | eval uid = clientip + useragent | eventstats dc(uid) as Visits | stats count as Views, first(Visits) as Visits by uri ... View more