++, although "Time Served" seems to point me into thinking the OP wants to know average time "viewed" per URL or some such. In this case the problem becomes a little more difficult, HTTP is a stateless protocol where you can't really tell that a user is on the same page from lasthit -> thishit in the log. You can define what you consider a page view duration with the last fact accepted, you just have to define it for yourself -- it does not really "mean" anything in the real world.

So to do a view duration you need a session of some type (based on key fields like client IP, timestamp and others in the log) or better yet a real session ID in the log that tells you for sure this is the same session -- not someone else on the same proxy server. After you have that defined you need to suck in the log and make a correlation between sessionID_last_hit and sessionID_next_hit The time that elapses between those two is the "viewed" time for the "SessionID_last_hit" page. Note you will want to have tests for outlying hits (what if the user started on index.html at 1pm yesterday, then started on page2.html today at 1pm, is that a 24hour view?) and do sanity cleaning on those cases. For examples of how some people have implemented this take a look at awstats.