awk Cheatsheet

Top patterns.

Overview

awk is the line-by-line text processor that has been part of Unix for fifty years. Five primitives carry most operational use: field-aware splitting, pattern-action pairs, BEGIN/END blocks, built-in variables, and a small library of math and string functions. Fluency turns ad-hoc log spelunking into compact one-liners that replace multi-tool pipelines.

• Field-aware processing. awk splits each line into $1, $2, ... by whitespace (or any -F separator). Column operations stay clean.
• Pattern-action pairs. /pattern/ {action} applies the action only to matching lines. Replaces grep | cut chains.
• BEGIN and END blocks. Setup before the first line, finalisation after the last. Supports running totals and report headers.
• Built-ins plus functions. NR, NF, FS for line/column counts; sprintf, gsub, arithmetic all available without external tools.

The approach

One-liners first, scripts only when the logic stops fitting on one line. Five idioms cover most operational awk use; memorising them moves the team from copy-paste to fluent text manipulation.

• awk '{print $2}'. Second field of whitespace-delimited input. Replaces cut for log-line columns.
• awk -F, '{print $1}'. CSV with comma separator. Handles arbitrary delimiters via -F.
• awk '/error/ {print $5}'. Filter then project in one pass. Replaces grep | awk two-step.
• awk '{sum+=$1} END {print sum}' plus NR==1. Running totals via END; NR==1 grabs first line, END grabs last. Compact arithmetic over streams.

Why this compounds

Each one-liner that lands in muscle memory shortens the next investigation. Over a year the team's log-triage speed compounds; over two years awk becomes the default for any column-shaped data and the patterns spread to teammates by osmosis.

• Faster log analysis. One-liners replace multi-tool pipelines. Investigation latency drops.
• Cleaner scripts. awk replaces brittle bash for column operations. Readability improves.
• Universal availability. Present on every Unix box. No dependencies, no install step.
• Year-one investment, year-two habit. First year builds fluency; by the second, every teammate reaches for awk before opening Excel.