Sorted Arrays

Sort array by value descending (GNU awk)

cat <<'EOF' > /tmp/demo.txt
sshd
nginx
sshd
vault
nginx
sshd
vault
nginx
nginx
haproxy
consul
nginx
sshd
EOF
awk '{count[$1]++} END{PROCINFO["sorted_in"]="@val_num_desc"; for(k in count) print count[k], k}' /tmp/demo.txt

Sort array by key alphabetically (GNU awk)

cat <<'EOF' > /tmp/demo.txt
vault 8200
nginx 443
haproxy 8443
bind 53
consul 8500
sshd 22
EOF
awk '{count[$1]++} END{PROCINFO["sorted_in"]="@ind_str_asc"; for(k in count) printf "%-20s %d\n", k, count[k]}' /tmp/demo.txt

Sort by piping to external sort — portable approach

printf '%s\n' ESTAB ESTAB TIME-WAIT ESTAB CLOSE-WAIT TIME-WAIT ESTAB TIME-WAIT ESTAB CLOSE-WAIT | awk '{count[$1]++} END{for(k in count) print count[k], k}' | sort -rn

Top N using PROCINFO — top 5 without external sort

cat <<'EOF' > /tmp/demo.txt
10.50.1.20
10.50.1.60
10.50.1.1
10.50.1.20
10.50.1.90
10.50.1.20
10.50.1.1
10.50.1.60
10.50.1.20
10.50.1.90
10.50.1.50
10.50.1.1
10.50.1.20
10.50.1.60
10.50.1.60
10.50.1.60
EOF
awk '{count[$1]++} END{
    PROCINFO["sorted_in"]="@val_num_desc"
    n=0
    for(k in count){if(++n>5) break; printf "%-20s %d\n", k, count[k]}
}' /tmp/demo.txt

Preserve insertion order — use NR as secondary key

cat <<'EOF' > /tmp/demo.txt
vault-01    active   10.50.1.60
ise-01      active   10.50.1.20
bind-01     standby  10.50.1.90
vault-01    active   10.50.1.60
pfsense-gw  active   10.50.1.1
ise-01      active   10.50.1.20
ad-dc-01    standby  10.50.1.50
EOF
awk '!seen[$1]++ {order[++n]=$1; data[$1]=$0} END{for(i=1;i<=n;i++) print data[order[i]]}' /tmp/demo.txt