Using access-logs and extracting just the IP address over time, the answer above does not work and provides not results.
timechart span=1d sum(count) by SourceIP limit=1000
Just using
| timechart by SourceIP
does work as expected, outputs the range of IP adresses seen by apache, however, these are not sorted by the most visited IP address.
... View more