numIP[$1] = NR;

tmp=substr($4,2,2);
if (day != tmp) {
   # New day code here
   # ie, print how many IPs were hit on this day
   print hits_on_this_day;
   # change day to match current record
   day = tmp;
}
else {
  hits_on_this_day++;
}

ip[$1]++;

BEGIN { m["Jan"]="01"; m["Feb"]="02"; } # and so on for all months
{ 

# split time field into numbers and letters
split($4,lt,"[^0-9a-zA-Z-]*"); 
# construct timestamp into internal unix representation
ts=mktime( lt[4] " " m[lt[3]] " " lt[2]  " " lt[5]  " " lt[6]  " " lt[7]  " " lt[8]); 
# you don't care about minutes and seconds, so just replace lt[7] and lt[6] with 0's. You could make *two* timestamps -- one for just the days (hours 0'd out) and another for just the hours (always Jan-1-1970, but with the hour filled in).

# bump count for this ip address
ip[$1]++; 
# 
day[ts]++;
}

END { 
  # find busiest day
  frequency=-1; busiest=-1;
  for (d in day) {
   if (day[d] > frequency) {
      frequency=day[d];
      busiest=d;
   }
  }
  print "busiest day: " busiest " hit " frequency " times";
  
}