There are a number of ways to track user behavior within web logs. One such method is to use the JSESSIONID which in this query is used. The variable you can/will change in this query is the reference to JSESSIONID as to better align with your web logs and web site(s) in general.

This working splunk query example will give you the top 20 pages based on visits (sessions) for a given time range.

sourcetype="iis" cs_Referer!="-" |dedup 20 JSESSIONID| top limit=21 cs_Referer |addtotals col=t labelfield=change_name label=Total |fields - Total | eval percent = round(percent,2) . " %" | rename count as Visits | rename percent as "% Visits" | rename change_name as "Subtotal for rows 1-20" | fields cs_Referer, "Subtotal for rows 1-20", Visits, "% Visits" |sort - Visits|rename cs_Referer to Page