Project: a log analyser

uniq compares each line with the one before it, so it counts a run of identical lines and nothing else. If the same address appears in two separate places, uniq sees two runs of one and reports each separately. Sorting first brings every copy together so there is a single run to collapse. Leave the sort out and the totals come out wrong, which is the mistake this pair is famous for.

awk splits each line on whitespace by default and numbers the fields from one, so the first field is taken from every line, not just the first line. In a web server log that field is the source address, which is exactly what the ranking needs. Printing the count of fields on a line would be a different variable, and selecting lines by their first character is a job for grep rather than awk.

The pattern matches any number from 500 to 599, but without the surrounding spaces it would also match those digits inside a longer number such as the size 15003. Wrapping the pattern in spaces means only a standalone three-digit field matches, which is what a status code is. The -c option is what turns the output into a count of matching lines rather than the lines themselves.

The field separator is set to a set containing the two bracket characters, so awk splits each line on either bracket and field two is the whole timestamp. Cutting that on the colon and keeping field two leaves the hour. Only then does the same sort, uniq -c and sort -nr pipeline rank the hours. A pattern search could pull out a shape of text, but it would not isolate the hour from the rest of the timestamp.