Shell Programming and Scripting

This doesn't work as you expect. $1 stays the same. It's the same as doing:

Code:

 numIP[$1] = NR;

So each element in the array would be filled with the latest Record number. I'd expect the last IP address to have the highest count.

With all respect, I think you are confused about how AWK works. Your "program" is executed for each line of input, every time. It's like there's a big while loop around your code, and in each iteration, $0 is the input line, and $1, $2, etc, are the fields split via the regular expression in FS (whitespace by default). NR just indicates the current record (line) number. If you want to know if the current record's day is not the same as the previous, you have something like:

Code:

tmp=substr($4,2,2);
if (day != tmp) {
   # New day code here
   # ie, print how many IPs were hit on this day
   print hits_on_this_day;
   # change day to match current record
   day = tmp;
}
else {
  hits_on_this_day++;
}

No need to initialize "day".