Many log questions are really "count and rank" questions, like the top IPs or the most common error. cut, sort, uniq and wc are tiny tools that answer them when chained with pipes. Use them for the classic "top 5 IPs in an access log" task that interviewers love. Always sort before uniq, and switch to awk when columns are separated by varying spaces.