2.8GB huh? Thems some pretty monstrous log files. Gonna take you a while to churn through them...

Well, I suspect what you'll find is that this isn't the only statistic you'll need, so why not shove the data into a database instead? Yes, this is going to be more time consuming in the short run, but it's fun to play with alternative suggestions...

So here's some code that shoves a Combined log format into an SQLite table. Of course you'll double your hard disk requirements, and it'll take probably a good couple of hours to create the database, but once you've done that you can pull off some pretty neat queries.

use strict;

use DBI;
use Time::Piece;
use Fatal qw(open close);

# parsing:
# 213.20.65.52 - - [01/Jan/2002:09:30:38 +0000] "GET /img/bg.gif HTTP/
+1.1" 200 268
#  "http://www.axkit.org/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows
+ NT 5.0; Q31 2461)"

use constant IP => 0;
use constant AUTH => 1;
use constant DATE => 2;
use constant REQUEST => 3;
use constant STATUS => 4;
use constant BYTES => 5;
use constant REFERER => 6;
use constant UA => 7;
use constant METHOD => 8;
use constant URI => 9;

my $logfile = $ARGV[0] || die "Usage: $0 filename\n";

open(LOG, $logfile);

my $dbh = DBI->connect("dbi:SQLite:$logfile.db","","",
    { AutoCommit => 0, RaiseError => 1 });

print "Dropping old table...\n";
eval {
    $dbh->do("DROP TABLE access_log");
};
print "Done\n";

$dbh->do(<<EOT);
CREATE TABLE access_log (
    when datetime not null,
    host varchar(255) not null,
    method varchar(10) not null,
    url varchar(500) not null,
    auth,
    browser,
    referer,
    status integer default 0,
    bytes integer
)

EOT

my $sth = $dbh->prepare(<<EOT);
INSERT INTO access_log VALUES (
    ?,?,?,?,?,?,?,?,?
)
EOT

my $line = 0;
while (<LOG>) {
    chomp; # superfluous, but we do it anyway
    $line++;
    my @vals;

    # adjust the regexp depending on your log format
    if (/^([^ ]*) [^ ]*? ([^ ]*?) \[([^\]]*?)\] "(.*?)" ([^ ]*?) ([^ ]
+*?) "(.*?)" "(.*?)"$/) {
        @vals = ($1,$2,$3,$4,$5,$6,$7,$8);
    }
    else {
        warn("Corrup log line: $_\n");
        next;
    }

    eval {
        $vals[DATE] = Time::Piece->strptime($vals[DATE], '%d/%b/%Y:%H:
+%M:%S +0000')->datetime;
    };
    if ($@) {
        die "Failed to parse $vals[DATE] on line $line\n";
    }

    if ($vals[REQUEST] =~ /^(\w+) ([^ ]+)/) {
        $vals[METHOD] = $1;
        $vals[URI] = $2;
    }
    else {
        warn "Couldn't parse: $vals[REQUEST] on line $line\n"
            if $vals[REQUEST] ne '-';
        $vals[METHOD] = "INVALID_METHOD";
        $vals[URI] = "-";
    }

    # print join(':', @vals), "\n";
    $sth->execute(@vals[DATE,IP,METHOD,URI,AUTH,UA,REFERER,STATUS,BYTE
+S]);

    unless ($line % 1000) {
        print "Completed $line lines, committing.\n";
        $dbh->commit;
    }
}

close LOG;

$sth->finish;
$dbh->disconnect;
[download]

Comments on the code welcome.