Don't ignore the header lines. They tell you the order of the fields, which can change whenever someone reconfigures IIS to emit different information into the logs. Try something along these lines:

my @fields = ();
my %fields = ();

while ( <LOG> ) {
    chomp;
    if ( m/^#/ ) {
        if ( s/^#Fields: // ) {
            @fields = split(/ /, $_);
        }
        next;
    }

    @fields{@fields} = split(/ /, $_);

    my $uri = $fields{'cs-uri-stem'};

    # The rest is left as an exercise