Top access log statistics by ip address

Top Command 1: Shell code timeawk & amp; #39; {print $1} & amp; #39; access. log | sort | uniq-c | sort-nr | header-578129192.168.13.16675165192.16... top Command 1: Shell code time awk '{print $1}' access. log | sort | uniq-c | sort-nr | head-5 78129 192.168.13.166 75165 192.168.12.52 58657 192.168.12.199 54146 192.168.13.183 34310 192.168.13.181 real 0m5. 849 s user 0m5. 566 s sys 0m0. 285 s Command 2: Shell code time awk '{a [$1] ++} END {for (I in a) {printf ("% d \ t % s \ n", a [I], I)} 'Access. log | sort-nr | head-5 78129 192.168.13.166 75165 192.168.12.52 58657 192.168.12.199 54146 192.168.13.183 34310 192.168.13.181 real 0m0. 626 s user 0m0. 549 s sys 0m0. the top two statistical commands above s are displayed at a glance. Command 1 is convenient and efficient; Command 2 is troublesome and efficient. The reason why I thought of comparing these two commands was due to an interview. at that time, my answer was command 2 (I used to use Command 2 before that, but I did not use Command 1 ). The other party immediately questioned the answer I gave. First, I doubt the correctness of the answer. "Isn't this method correct ?". When I explained that I have used this command in my work, I questioned the efficiency of this command. "There should be more efficient methods !". What I actually want to say is that sometimes the interview may not be able to identify the real problem.