Linux · text processing

cut

pick out columns

cut keeps part of every line and discards the rest. Tell it the separator with -d and the fields wanted with -f, and a file with columns is reduced to just the ones you asked for.

-d names the separator, -f names the fields. Fields count from 1.

Selects

Columns

from every line

Separator

-d CHAR

a tab unless given

Fields

-f 1,3 or -f 2-4

a list or a range

Characters

-c 1-10

by position instead

At the terminal

Read the session first, then the notes: each numbered line in the output is answered by the note with the same number.

user@netflow — bashcoreutils

$ cut -d: -f1 /etc/passwd | head -3

1root

daemon

bin

2$ cut -d: -f1,7 /etc/passwd | tail -1

user:/bin/bash

3$ cut -d, -f2-3 data.csv | head -2

name,department

Asha,Engineering

Illustrative session · names, sizes and dates are examples, and every address is from a documentation or private range

Reading the output

What the numbered lines are telling you

The first field of each line

/etc/passwd separates its fields with colons, and the first is the account name. This lists every user.

Two fields, kept with their separator

Fields 1 and 7: the name and the login shell. The colon between them is preserved in the output.

A range of fields

2-3 means the second to the third. With -d, the same works on a CSV file.

Switches

A switch changes how the command behaves. These are the ones used day to day; man cut lists the rest. Single-letter switches can usually be joined, so -l -a may be written -la.

-d CHAR: Use this character as the field separator instead of a tab.
-f LIST: Select these fields: 1,3 or 2-4 or 3-.
-c LIST: Select these character positions.
-s: Skip lines that do not contain the separator.
--complement: Print everything except the selected fields.

Variations worth knowing

The same tool, pointed at a narrower question. These four cover most of what it is reached for day to day.

cut -c 1-80 long.txt

Keeps the first 80 characters of each line.

cut -d" " -f1 access.log

Takes the first space-separated field: the client address.

cut -f2 data.tsv

With no -d, fields are separated by tabs.

echo $PATH | cut -d: -f1

Shows the first directory in PATH.

In cybersecurity

Reducing a log to one column is what makes it countable.

Listing who can log in

cut -d: -f1,7 /etc/passwd shows each account with its shell. Accounts with a real shell that should not have one are worth questioning.

Extracting addresses and users

Most log analysis begins by cutting out the field of interest — address, user, URL — and handing it to sort and uniq.

It splits on one character only

cut cannot handle repeated spaces or quoted commas, and will quietly take the wrong column. Use awk for those.

Filed under

Text processing

Read alongside

awkProcesses text column by column: prints, filters and totals fields from each line.sortSorts lines of text — alphabetically, numerically, or by a chosen column.