Counting

cat <<'EOF' > /tmp/demo.txt
10.50.1.10 GET /api/health
10.50.1.20 POST /api/auth
10.50.1.10 GET /api/users
10.50.1.30 GET /api/health
10.50.1.10 DELETE /api/sessions
10.50.1.20 GET /api/health
EOF
awk '{count[$1]++} END{for(k in count) print count[k], k}' /tmp/demo.txt | sort -rn

cat <<'EOF' > /tmp/demo.txt
2026-04-11 INFO  Service started
2026-04-11 ERROR Connection refused to 10.50.1.50:636
2026-04-11 WARN  Certificate expiring in 7 days
2026-04-11 ERROR Timeout waiting for 10.50.1.20:443
2026-04-11 INFO  Health check passed
2026-04-11 ERROR LDAP bind failed
EOF
awk '/ERROR/{count++} END{print count}' /tmp/demo.txt

cat <<'EOF' > /tmp/demo.txt
10.50.1.10 GET /api/health
10.50.1.20 POST /api/auth
10.50.1.10 GET /api/users
10.50.1.30 GET /api/health
10.50.1.10 DELETE /api/sessions
10.50.1.20 GET /api/health
10.50.1.40 GET /api/status
10.50.1.10 GET /api/health
10.50.1.50 POST /api/auth
10.50.1.10 GET /api/health
10.50.1.30 POST /api/users
10.50.1.20 GET /api/status
EOF
awk '{count[$1]++} END{for(k in count) print count[k], k}' /tmp/demo.txt | sort -rn | head -10

printf '%s\n' 10.50.1.10 10.50.1.20 10.50.1.10 10.50.1.30 10.50.1.20 10.50.1.40 | awk '!seen[$0]++'

ss -ta | awk 'NR>1 {state[$1]++} END{for(s in state) printf "%-15s %d\n",s,state[s]}'

journalctl --since "1 hour ago" --no-pager -o short | awk '{unit[$5]++} END{for(u in unit) print unit[u], u}' | sort -rn | head -10

awk -F: '{shells[$7]++} END{for(s in shells) print shells[s], s}' /etc/passwd | sort -rn

cat <<'EOF' > /tmp/demo.txt
web-01   200
db-01    503
web-01   200
web-02   404
db-01    200
web-01   503
web-02   200
db-01    200
EOF
awk '{count[$1]++} END{for(k in count) printf "%-20s %d\n", k, count[k]}' /tmp/demo.txt | sort -k2 -rn