There are actually only two little things that keep your code from working:

1. You declare (and unnecessarily clear) %ips inside the loop.
2. You assign the line contents to $ips{$site} instead of incrementing a counter there. $ips{$site}++ is fine---if the element doesn't exist, it will read as undef which in numeric context is a zero.

I don't know how big your logs are but another thing you could do is improve that regexp: be as specific as you can about each field. At the very least that means specifying a non-blank character where you need one/ On my machine, parsing a typical log line with your version takes about 5.2µs; if I change $w to /(\S+?)/, it's just about 0.9µs. Adding an /o flag to only have it interpolate and compile the regexp once brings it down to 0.35µs. I'm not sure why the difference is so big as there's not that much backtracking¹ but anyway it helps. I didn't benchmark whether it makes a speed difference but the assignment is much shorter to write as follows:

my ($site, $logName, $fullName, $date, $time, $gmt, $req, $file, $prot
+o, $status, $length) =
$line =~ /^$w .../o;
[download]

¹ Using $w = "(.+)" which really backtracks lot takes a whopping 185µs per line.