grab frequent username from 'last' command in unix - with exceptions

Question

If I run this on OS X:

last -10 | awk '{print $1}'

I get: chop
chop
chop
chrihopk
reboot
shutdown
chop
chop
chop
chrihopk

How do I use sed or awk to obtain the most frequent user 'chop'?

ADDITIONAL EDIT TO QUESTION:
Our local admin account interferes with the results (username: support) and often we have a new starter on a client box.
How could I modify

last -1

to omit the following and return the last valid username:

support
reboot
shutdown

Thanks

Answer 1

If you pipe that into sort, you'll get an easily parsable list of data to find the most frequent user, although I don't know how to find that user without a scripting language.

Answer 2

bash$ last -10 | awk '{print $1}' | sort | uniq -c | sort -nr | head -1 | awk '{print $2}'

sort -un does something, but I'm not sure what...

bash$ echo -e 'bob\nbob\ncat\ncat\ncat\ndog'
bob
bob
cat
cat
cat
dog
bash$ echo -e 'bob\nbob\ncat\ncat\ncat\ndog' | sort | uniq -c | sort -nr
      3 cat
      2 bob
      1 dog
bash$ echo -e 'bob\nbob\ncat\ncat\ncat\ndog' | sort -un
bob
bash$ echo -e 'bob\nbob\ncat\ncat\ncat\ndog' | sort | uniq -c | sort -nr | head -n1 | awk '{print $2}'
cat

Answer 3

The following pipeline offers a starting point, which I'm certain could be optimized:

last | awk '{A[$1] += 1; for (v in A) print A[v],v}' | sort -ur | head -n 1 | awk '{print $2}'

Answer 4

If you want

• a nice ascending-ordered list of users with number of logins (the $0!~/^$/ stuff only assures blank lines will not be counted):

  last | awk '$0!~/^$/ {print $1}' | sort | uniq -c | sort
  

• username with logins number:

  append | tail -1 to the code above.

• same as above in awk (faster):

  last | awk '{a[$1]++}END{m=0;for(v in a){if(a[v]>m){m=a[v];u=v}}print m,u}'
  

• username only in awk:

  delete the last m, from the code above.

Answer 5

just awk

last -10 |awk '{ user[$1]++}
END{
    t=0
    for(i in user){
        if (user[i]>t) {
            t=user[i]
            u=i
        }
    }
    print t,u
}'

with gawk, you can make use of the asort, asorti internal functions

Answer 6

In answer to your edit, leave off the numeric argument to last and use egrep like this:

last | egrep -v 'support|reboot|shutdown'

then pipe that into awk as in the other answers.