You may be able to query whatever device is producing these logs in realtime over SNMP and ask it directly how many sessions are currently active. Then, you would be able to use something like RRDtool (and its Perl wrapper library) with an SNMP frontend.
PS. incremental is confusing.
Comment on Re^5: How to Iterate to Identify Concurrent Users (SNMP)