Splunk SPL: Apache Unique Visitors by Day

Track daily unique visitors to understand audience trends and traffic shifts.

What This Splunk Query Does

Counts distinct client IPs per day.

Supported Sourcetypes

access_combined

When to Use This SPL

Use this to measure traffic growth, campaign impact, or seasonal patterns.

Splunk SPL Query

This Splunk query uses index=* as a placeholder. Replace it with your actual index name.

index=* sourcetype=access_combined
| eval client_ip=coalesce(clientip, src_ip, c_ip)
| where isnotnull(client_ip)
| timechart span=1d dc(client_ip) as unique_visitors

Assumptions and Customization

Assumes client IP is stored in clientip, src_ip, or c_ip. Add by host for per-server counts.