That turns out to be hard because in your typical log file you have bursts of requests localized to a particular part of the file that get something into the to

That turns out to be hard because in your typical log file you have bursts of requests localized to a particular part of the file that get something into the top-N without even appearing in other segments. So essentially you can end up having to do a complete N-way merge between the segments to make sure you really find the top hits.