Linux one command counts Nginx access IP

Access log example

192.xxx.xxx.xxx--[17/04/2020:02:58:45 +0000] "GET / HTTP/1.1" 502 166 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv :64.0) Gecko/20100101 Firefox/64.0"
10.xxx.xxx.xxx--[17/04/2020:02:58:45 +0000] "GET / HTTP/1.1" 502 166 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv :64.0) Gecko/20100101 Firefox/64.0"
43.xxx.xxx.xxx--[17/04/2020:02:58:45 +0000] "GET / HTTP/1.1" 502 166 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv :64.0) Gecko/20100101 Firefox/64.0"

Statistics command

Extract access IP

cat access.log |awk'{print$1}'

21.39.167.131
122.117.57.136
22.203.185.65
172.50.45.66
40.59.251.60
182.252.87.138
82.98.164.250
117.125.39.35
244.33.172.7
231.226.157.103
...

Count the number of IP visits

cat access.log |awk'{print1}'|sort|uniq -c

10 236.11.168.37
22 17.230.208.37
3 139.46.101.227
1 239.116.73.255
1 124.60.114.227
1 255.21.72.166
70 83.217.204.84
121 251.133.40.224
32 183.75.222.91
102 30.143.157.245
...

Display in reverse order based on the number of visits

cat access.log | awk'{print$1}' |sort|uniq -c|sort -rn

334 182.138.158.183
250 182.138.158.67
158 182.138.158.156
84 182.138.137.127
16 36.32.3.46
10 123.245.24.149
8 163.177.13.2
7 182.96.12.70
6 39.100.240.14
6 39.100.231.247
...

Extract the top 5 IPs and the number of visits

cat access.log | awk'{print$1}' |sort|uniq -c|sort -rn|head -5

334 182.138.158.183
250 182.138.158.67
158 182.138.158.156
84 182.138.137.127
16 36.32.3.46