Top-K IP Addresses Across Log Files
Reported by candidates from Render's online assessment. Pattern, common pitfall, and the honest play if you blank under the timer.
The Render OA reported in September 2026 hides its real question in one line: keep counts for only one partition plus O(k) selection state. The base task is simple. Count each IPv4 string, then return the k most frequent, ties broken by ascending lexicographic order. It's a hash map plus heap problem, and the GB-scale follow-up is where people stall. If you blank on the tie-break or the partitioning story mid-assessment, StealthCoder runs invisibly on your desktop and hands you the working solution. Better to know the shape before you open the timer.
The problem
The array addresses represents the records of a newline-delimited file, with one IP address per record. Every record is a valid canonical IPv4 address. Return the k most frequent addresses, ordered by decreasing occurrence count. When two addresses have the same count, order them by ascending lexicographic string order. The result must be exact; approximate heavy-hitter results are not accepted. GB-Scale Resource Model The callable judge materializes the file records in addresses. For the original external-file setting, multiple sequential passes and deterministic external hash partition files are allowed. The bounded-memory target is to keep the counts for only one partition plus O(k) selection state in working memory; temporary disk storage is not counted as working memory. Choose enough partitions that each partition's distinct-address counts fit the available working-memory budget. Function topKIpAddresses(addresses: String[], k: int) → String[] Examples Example 1 addresses = ["10.0.0.1","10.0.0.2","10.0.0.1","192.168.1.1","10.0.0.2","10.0.0.1"] k = 2 return = ["10.0.0.1","10.0.0.2"] 10.0.0.1 appears three times, 10.0.0.2 appears twice, and 192.168.1.1 appears once. The first two addresses therefore form the result. Example 2 addresses = ["2.0.0.1","1.0.0.1","3.0.0.1","2.0.0.1","1.0.0.1"] k = 2 return = ["1.0.0.1","2.0.0.1"] 1.0.0.1 and 2.0.0.1 each appear twice. Their equal counts are resolved by ascending lexicographic order. Constraints 1 <= addresses.length <= 200000 for the callable judge adapter. Every element of addresses is a canonical IPv4 dotted-decimal string with four octets from 0 through 255 and no leading zero in a multi-digit octet. 1 <= k <= the number of distinct addresses. The output contains exactly k addresses. The external-file follow-up requires an exact result and permits multiple sequential passes and temporary partition files.
Reported by candidates. Source: FastPrep
Pattern and pitfall
The core trick is a frequency map followed by top-k selection. Count with a hash map, then keep a min-heap of size k where the worst element sits on top. The pitfall is the comparator. The worst element has the lowest count, and on equal counts the lexicographically larger string. Get that backwards and Example 2 flips. Sorting all distinct entries by (-count, string) also passes at 200000 records, in O(n log n). For the external-file follow-up, hash each address into P partition files, so every copy of one address lands in the same file. Count one partition at a time, push its entries through the size-k heap, then discard the counts. Exactness holds because no address spans partitions. Don't reach for approximate sketches, the statement rules them out. If the comparator or partition logic slips under pressure, StealthCoder is the hedge during the live OA.
The honest play: practice the pattern, and have StealthCoder ready for the one you didn't see coming.
You can drill Top-K IP Addresses Across Log Files cold, or you can hedge it. StealthCoder runs invisibly during screen share and surfaces a working solution in under 2 seconds. The proctor sees the IDE. They don't see what's behind it. Built for the candidate who saw this exact problem leak two days before his OA and wondered if anyone had a play.
Get StealthCoderRelated leaked OAs
This OA pattern shows up on LeetCode as top k frequent words. If you have time before the OA, drill that.
You've seen the question.
Make sure you actually pass Render's OA.
Render reuses patterns across OAs. Built for the candidate who saw this exact problem leak two days before his OA and wondered if anyone had a play. Works on HackerRank, CodeSignal, CoderPad, and Karat.
Top-K IP Addresses Across Log Files FAQ
What's the trick in the Render top-K IP problem?+
Count addresses in a hash map, then select the top k with a size-k heap or a plain sort. The real catch is the tie-break: equal counts order by ascending lexicographic string. Get the comparator right and the base problem is easy.
Do I need to implement the external partitioning for the OA?+
The callable judge gives you the full addresses array, so an in-memory map passes the tests. The partition model is a stated follow-up. Know the explanation: hash each address to a partition file, count one partition at a time, and merge into a size-k heap.
Should I use a heap or just sort?+
Both work at 200000 records. Sorting distinct entries by descending count then ascending string is shorter and harder to get wrong. A heap gives O(n log k) and matches the O(k) selection state in the memory model. Pick sorting if you're nervous.
Why can't I use an approximate heavy-hitter method?+
The statement requires an exact result and rejects approximate output. Count-min sketches or sampling can miscount near the cutoff. Hash partitioning keeps every occurrence of an address in one file, so counts stay exact.
How do I prepare for this in 48 hours?+
Write top-k frequent elements from scratch twice, once with a heap and once with a sort. Then add the custom tie-break on strings. Rehearse a two-sentence answer for the partitioning follow-up. That covers everything this problem asks.