Unix Log Analysis Pipeline — Top 5 Requested URLs Diagram

Every line of access.log records one served request — for example: GET /css/typography.css 200
awk '{print $7}' splits each line into whitespace-separated fields and keeps field 7: the requested URL
sort orders the URLs alphabetically, so every repeated URL appears as one consecutive run
uniq -c collapses each run into a single line: URL plus a counter of how many times it was requested
sort -r -n sorts by that count numerically in reverse (largest first); head -n 5 prints the first five lines

GNU sort spills to disk: chunks are sorted in memory and written out as sorted segment files
Mergesort then merges the sorted segments into one large sorted file, using sequential reads and writes
No in-memory hash table of all URLs is needed, so the job keeps working when the working set exceeds memory
The bottleneck becomes the rate at which the input file can be read from disk
Unix tools still run on a single machine — datasets too large for one disk need distributed batch processing