Sort uniq IP address in from Apache log Sort uniq IP address in from Apache log bash bash

Sort uniq IP address in from Apache log


This may be late, but using the numeric in the first sort will give you the desired result,

cat access.log | awk '{print $1}' | sort -n | uniq -c | sort -nr | head -20

Output:

 29877 93.xxx.xxx.xxx  17538 80.xxx.xxx.xxx   5895 198.xxx.xxx.xxx   3042 37.xxx.xxx.xxx   2956 208.xxx.xxx.xxx   2613 94.xxx.xxx.xxx   2572 89.xxx.xxx.xxx   2268 94.xxx.xxx.xxx   1896 89.xxx.xxx.xxx   1584 46.xxx.xxx.xxx   1402 208.xxx.xxx.xxx   1273 93.xxx.xxx.xxx   1054 208.xxx.xxx.xxx    860 162.xxx.xxx.xxx    830 208.xxx.xxx.xxx    606 162.xxx.xxx.xxx    545 94.xxx.xxx.xxx    480 37.xxx.xxx.xxx    446 162.xxx.xxx.xxx    398 162.xxx.xxx.xxx


Why use cat | awk? You only need to use awk:

awk '{ print $1 }' /var/log/*access*log | sort -n | uniq -c | sort -nr | head -20


I don't know why a simple sort -n didn't work, but adding a non numeric character between the counter and the IP soved my issue.

cat access.* | awk '{ print $1 } ' | sort | uniq -c | sed -r 's/^[ \t]*([0-9]+) (.*)$/\1 --- \2/' | sort -rn