cat /path/to/log | awk '{print $3}' | sort | uniq -c | sort -rn | head -20

we grab the 3rd column (using awk), we sort all the results, we then unique that output (-c gives us a count), and then sort numerically based on the count

we also sort ascending (-r) ... the head then gives us the top 20 IP addresses

Analyse Access Log, find most common ip addresses

Bash