I sometimes in interviews I ask how to find the top 10 IP addresses that have hit a web host in the last thousand hits.

tail -1000 access.log | cut -d' ' -f1 | sort | uniq -c | sort -rn | head