sed/awk/grep Cheatsheet - Linux Text Processing Reference

Rather than memorizing three manuals, remember one division of labor: grep narrows the lines, sed rewrites the values, awk sums or groups the fields. This table gives you the daily-reachable subset of each, plus combined pipelines, so log triage and report building stay a few keystrokes instead of a script.

SysOps·52 commands·Last updated 2026-07-21

grep Match & Search 10

grep "error" app.log

Find lines containing 'error'

grep -i "error" app.log

Case-insensitive match

grep -rn "TODO" src/

Recursively search a dir, show file and line number

grep -v "debug" app.log

Invert match, exclude lines with 'debug'

grep -c "error" app.log

Count matching lines

grep -E "error|warning" app.log

Extended regex, equivalent to egrep

grep -oE "[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+" access.log

Print only the matched IP address

grep -A 3 "error" app.log

Show 3 lines of context after a match

grep -B 2 "error" app.log

Show 2 lines of context before a match

grep -f pattern.txt app.log

Read multiple patterns from a file

sed Replace & Edit 9

sed 's/old/new/g' file.txt

Replace old with new globally

sed -i 's/old/new/g' file.txt

Edit the file in place

sed -i.bak 's/old/new/g' file.txt

Edit in place and back up the original as .bak

sed '5d' file.txt

Delete line 5

sed '/^#/d' file.conf

Delete all comment lines starting with #

sed '/^$/d' file.txt

Delete blank lines

sed -n '10,20p' file.txt

Print only lines 10-20

sed 's/[[:space:]]*$//' file.txt

Strip trailing whitespace

sed -E 's/([0-9]+)/\1/' file.txt

Extended-regex capture group, -E same as -r

awk Extract & Summarize 9

awk '{print $1}' access.log

Print column 1 (whitespace-delimited by default)

awk -F: '{print $1, $3}' /etc/passwd

Colon-delimited, print username and UID

awk 'NR==10' file.txt

Print line 10 (NR = line number)

awk 'NR>=10 && NR<=20' file.txt

Print lines 10-20

awk '{sum += $1} END {print sum}' nums.txt

Sum column 1

awk '{count[$1]++} END {for(k in count) print k, count[k]}' access.log

Group by column 1 and count occurrences

awk '$3 > 100' data.txt

Print rows where column 3 > 100

awk 'length > 80' file.txt

Print rows longer than 80 chars

awk -F: '$3 >= 1000 {print $1}' /etc/passwd

List normal users with UID >= 1000

Pipelines 4

grep "error" app.log | awk "{print \$1}" | sort | uniq -c | sort -rn | head

Top timestamps by error-log count

cat access.log | awk "{print \$1}" | sort | uniq -c | sort -rn | head -20

Top 20 IPs by request volume

grep -oE "[0-9]+ms" app.log | sort -rn | head -10

Top 10 response times

sed '/^#/d; /^$/d' nginx.conf

Delete comment and blank lines in one pass (separate commands with ;)

sort / uniq / comm 10

sort file.txt

Sort file contents (lexical by default)

sort -n file.txt

Sort numerically

sort -r file.txt

Reverse sort

sort -t: -k3 -n /etc/passwd

Sort by column 3 (colon-delimited) numerically

sort -u file.txt

Sort and deduplicate

sort file.txt | uniq -c | sort -rn | head

Classic combo: top row frequencies

uniq -c file.txt

Count consecutive duplicates (sort first)

uniq -d file.txt

Show only duplicated lines

comm file1 file2

Compare two sorted files: three columns (only file1 / only file2 / both)

diff -u file1 file2

Compare files in unified format

cut / tr / paste 10

cut -d: -f1 /etc/passwd

Extract column 1 by colon delimiter

cut -c1-10 file.txt

Extract characters 1-10 by position

cut -f1,3 file.txt

Extract columns 1 and 3 (Tab-delimited by default)

tr 'a-z' 'A-Z' < file.txt

Lowercase to uppercase

tr -d ' \t' < file.txt

Delete all spaces and tabs

tr -s '\n' < file.txt

Squeeze consecutive blank lines into one

paste file1.txt file2.txt

Merge files side by side (Tab-delimited)

column -t file.txt

Align content into a table

expand file.txt

Convert tabs to spaces

command | tee output.txt

Output to both screen and file (common in pipelines)

Tips

Back up before sed -i edits a file (-i.bak), or preview without -i first.
For large files, add --line-buffered so grep flushes output live; otherwise the pipe waits for the buffer to fill.
In awk, $1 inside single quotes gets the column; inside double quotes escape it as \$1 or the shell will expand it.

Official References

Each command links to its official documentation below, so you can verify the latest usage and read deeper.

Linux man-pages

Maintained by LaoHand

Publicly updated on Jul 21, 2026, continuously proofread against official docs.

Contact Us

Wrong command or description? Send us corrections, business inquiries or product feedback by email.