Awk Tips and Tricks

Hi guys and girls, this is the first and only guest post on my blog. It's written by Waldner from #awk on FreeNode IRC Network. He works as a sysadmin and does shell scripting as a hobby. Waldner will be happy to take any questions about the article. You can ask them in the comments of this post or on IRC.

This article takes a look at ten tips, tricks and pitfalls in Awk programming language. They are mostly taken from the discussions in #awk IRC channel. Here they are:

Be idiomatic!

Update: Mr. Waldner just notified me that he has improved the tips on being idiomatic. See "Idiomatic Awk" on his website!

In this paragraph, we give some hints on how to write more idiomatic (and usually shorter and more efficient) awk programs. Many awk programs you're likely to encounter, especially short ones, make large use of these notions.

Suppose one wants to print all the lines in a file that match some pattern (a kind of awk-grep, if you like). A reasonable first shot is usually something like

awk '{if ($0 ~ /pattern/) print $0}'

That works, but there are a number of things to note.

The first thing to note is that it is not structured according to the awk's definition of a program, which is

condition { actions }

Our program can clearly be rewritten using this form, since both the condition and the action are very clear here:

awk '$0 ~ /pattern/ {print $0}'

Our next step in the perfect awk-ification of this program is to note that /pattern/ is the same as $0 ~ /pattern/. That is, when awk sees a single regular expression used as an expression, it implicitly applies it to $0, and returns success if there is a match. Then we have:

awk '/pattern/ {print $0}'

Now, let's turn our attention to the action part (what's inside braces). print $0 is a redundant statement, since print alone, by default, prints $0.

awk '/pattern/ {print}'

But now we note that, when it finds that a condition is true, and there are no associated actions, awk performs a default action that is (you guessed it) print (which we already know is equivalent to print $0). Thus we can do this:

awk '/pattern/'

Now we have reduced the initial program to its simplest (and more idiomatic) form. In many cases, if all you want to do is print some lines, according to a condition, you can write awk programs composed only of a condition (although complex):

awk '(NR%2 && /pattern/) || (!(NR%2) && /anotherpattern/)'

That prints odd lines that match /pattern/, or even lines that match /anotherpattern/. Naturally, if you don't want to print $0 but instead do something else, then you'll have to manually add a specific action to do what you want.

From the above, it follows that

awk 1
awk '"a"'   # single quotes are important!

are both awk programs that just print their input unchanged. Sometimes, you want to operate only on some lines of the input (according to some condition), but also want to print all the lines, regardless of whether they were affected by your operation or not. A typical example is a program like this:

awk '{sub(/pattern/,"foobar")}1'

This tries to replace "pattern" with "foobar". Whether or not the substitution succeeds, the always-true condition "1" prints each line (you could even use "42", or "19", or any other nonzero value if you want; "1" is just what people traditionally use). This results in a program that does the same job as sed 's/pattern/foobar/'. Here are some examples of typical awk idioms, using only conditions:

awk 'NR % 6'            # prints all lines except those divisible by 6
awk 'NR > 5'            # prints from line 6 onwards (like tail -n +6, or sed '1,5d')
awk '$2 == "foo"'       # prints lines where the second field is "foo"
awk 'NF >= 6'           # prints lines with 6 or more fields
awk '/foo/ && /bar/'    # prints lines that match /foo/ and /bar/, in any order
awk '/foo/ && !/bar/'   # prints lines that match /foo/ but not /bar/
awk '/foo/ || /bar/'    # prints lines that match /foo/ or /bar/ (like grep -e 'foo' -e 'bar')
awk '/foo/,/bar/'       # prints from line matching /foo/ to line matching /bar/, inclusive
awk 'NF'                # prints only nonempty lines (or: removes empty lines, where NF==0)
awk 'NF--'              # removes last field and prints the line
awk '$0 = NR" "$0'      # prepends line numbers (assignments are valid in conditions)

Another construct that is often used in awk is as follows:

awk 'NR==FNR { # some actions; next} # other condition {# other actions}' file1 file2

This is used when processing two files. When processing more than one file, awk reads each file sequentially, one after another, in the order they are specified on the command line. The special variable NR stores the total number of input records read so far, regardless of how many files have been read. The value of NR starts at 1 and always increases until the program terminates. Another variable, FNR, stores the number of records read from the current file being processed. The value of FNR starts from 1, increases until the end of the current file, starts again from 1 as soon as the first line of the next file is read, and so on. So, the condition "NR==FNR" is only true while awk is reading the first file. Thus, in the program above, the actions indicated by "# some actions" are executed when awk is reading the first file; the actions indicated by "# other actions" are executed when awk is reading the second file, if the condition in "# other condition" is met. The "next" at the end of the first action block is needed to prevent the condition in "# other condition" from being evaluated, and the actions in "# other actions" from being executed while awk is reading the first file.

There are really many problems that involve two files that can be solved using this technique. Here are some examples:

# prints lines that are both in file1 and file2 (intersection)
awk 'NR==FNR{a[$0];next} $0 in a' file1 file2

Here we see another typical idiom: a[$0] has the only purpose of creating the array element indexed by $0. During the pass over the first file, all the lines seen are remembered as indexes of the array a. The pass over the second file just has to check whether each line being read exists as an index in the array a (that's what the condition $0 in a does). If the condition is true, the line is printed (as we already know).

Another example. Suppose we have a data file like this

20081010 1123 xxx
20081011 1234 def
20081012 0933 xyz
20081013 0512 abc
20081013 0717 def
...thousand of lines...

where "xxx", "def", etc. are operation codes. We want to replace each operation code with its description. We have another file that maps operation codes to human readable descriptions, like this:

abc withdrawal
def payment
xyz deposit
xxx balance
...other codes...

We can easily replace the opcodes in the data file with this simple awk program, that again uses the two-files idiom:

# use information from a map file to modify a data file
awk 'NR==FNR{a[$1]=$2;next} {$3=a[$3]}1' mapfile datafile

First, the array a, indexed by opcode, is populated with the human readable descriptions. Then, it is used during the reading of the second file to do the replacements. Each line of the datafile is then printed after the substitution has been made.

Another case where the two-files idiom is useful is when you have to read the same file twice, the first time to get some information that can be correctly defined only by reading the whole file, and the second time to process the file using that information. For example, you want to replace each number in a list of numbers with its difference from the largest number in the list:

# replace each number with its difference from the maximum
awk 'NR==FNR{if($0>max) max=$0;next} {$0=max-$0}1' file file

Note that we specify "file file" on the command line, so the file will be read twice.

Caveat: all the programs that use the two-files idiom will not work correctly if the first file is empty (in that case, awk will execute the actions associated to NR==FNR while reading the second file). To correct that, you can reinforce the NR==FNR condition by adding a test that checks that also FILENAME equals ARGV[1].

Pitfall: shorten pipelines

It's not uncommon to see lines in scripts that look like this:

somecommand | head -n +1 | grep foo | sed 's/foo/bar/' | tr '[a-z]' '[A-Z]' | cut -d ' ' -f 2

This is just an example. In many cases, you can use awk to replace parts of the pipeline, or even all of it:

somecommand | awk 'NR>1 && /foo/{sub(/foo/,"bar"); print toupper($2)}'

It would be nice to collect here many examples of pipelines that could be partially or completely eliminated using awk.

Print lines using ranges

Yes, we all know that awk has builtin support for range expressions, like

# prints lines from /beginpat/ to /endpat/, inclusive
awk '/beginpat/,/endpat/'

Sometimes however, we need a bit more flexibility. We might want to print lines between two patterns, but excluding the patterns themselves. Or only including one. A way is to use these:

# prints lines from /beginpat/ to /endpat/, not inclusive
awk '/beginpat/,/endpat/{if (!/beginpat/&&!/endpat/)print}'

# prints lines from /beginpat/ to /endpat/, not including /beginpat/
awk '/beginpat/,/endpat/{if (!/beginpat/)print}'

It's easy to see that there must be a better way to do that, and in fact there is. We can use a flag to keep track of whether we are currently inside the interesting range or not, and print lines based on the value of the flag. Let's see how it's done:

# prints lines from /beginpat/ to /endpat/, not inclusive
awk '/endpat/{p=0};p;/beginpat/{p=1}'

# prints lines from /beginpat/ to /endpat/, excluding /endpat/
awk '/endpat/{p=0} /beginpat/{p=1} p'

# prints lines from /beginpat/ to /endpat/, excluding /beginpat/
awk 'p; /endpat/{p=0} /beginpat/{p=1}'

All these programs just set p to 1 when /beginpat/ is seen, and set p to 0 when /endpat/ is seen. The crucial difference between them is where the bare "p" (the condition that triggers the printing of lines) is located. Depending on its position (at the beginning, in the middle, or at the end), different parts of the desired range are printed. To print the complete range (inclusive), you can just use the regular /beginpat/,/endpat/ expression or use the flag technique, but reversing the order of the conditions and associated patterns:

# prints lines from /beginpat/ to /endpat/, inclusive
awk '/beginpat/{p=1};p;/endpat/{p=0}'

It goes without saying that while we are only printing lines here, the important thing is that we have a way of selecting lines within a range, so you can of course do anything you want instead of printing.

Split file on patterns

Suppose we have a file like this


We want to split this file on all the occurrences of lines that match /^FOO/, and create a series of files called, for example, out1, out2, etc. File out1 will contain the first 4 lines, out2 will contain "line5" and "line6", etc. There are at least two ways to do that with awk:

# first way, works with all versions of awk
awk -v n=1 '/^FOO[0-9]*/{close("out"n);n++;next} {print > "out"n}' file

Since we don't want to print anything when we see /^FOO/, but only update some administrative data, we use the "next" statement to tell awk to immediately start processing the next record. Lines that do not match /^FOO/ will instead be processed by the second block of code. Note that this method will not create empty files if an empty section is found (eg, if "FOO5\nFOO6" is found, the file "out5" will not be created). The "-v n=1" is used to tell awk that the variable "n" should be initialized with a value of 1, so effectively the first output file will be called "out1".

Another way (which however needs GNU awk to work) is to read one chunk of data at a time, and write that to its corresponding out file.

# another way, needs GNU awk
LC_ALL=C gawk -v RS='FOO[0-9]*\n' -v ORS= '{print > "out"NR}' file

The above code relies on the fact that GNU awk supports assigning a regular expression to RS (the standard only allows a single literal character or an empty RS). That way, awk reads a series of "records", separated by the regular expression matching /FOO[0-9]*\n/ (that is, the whole FOO... line). Since newlines are preserved in each section, we set ORS to empty since we don't want awk to add another newline at the end of a block. This method does create an empty file if an empty section is encountered. On the downside, it's a bit fragile because it will produce incorrect results if the regex used as RS appears somewhere else in the rest of the input.

We will see other examples where gawk's support for regexes as RS is useful. Note that the last program used LC_ALL=C at the beginning...

Locale-based pitfalls

Sometimes awk can behave in an unexpected way if the locale is not C (or POSIX, which should be the same). See for example this input:

-rw-r--r-- 1 waldner users 46592 2003-09-12 09:41 file1
-rw-r--r-- 1 waldner users 11509 2008-10-07 17:42 file2
-rw-r--r-- 1 waldner users 11193 2008-10-07 17:41 file3
-rw-r--r-- 1 waldner users 19073 2008-10-07 17:45 file4
-rw-r--r-- 1 waldner users 36332 2008-10-07 17:03 file5
-rw-r--r-- 1 waldner users 33395 2008-10-07 16:53 file6
-rw-r--r-- 1 waldner users 54272 2008-09-18 16:20 file7
-rw-r--r-- 1 waldner users 20573 2008-10-07 17:50 file8

You'll recognize the familiar output of ls -l here. Let's use a non-C locale, say, en_US.utf8, and try an apparently innocuous operation like removing the first 3 fields.

$ LC_ALL=en_US.utf8 awk --re-interval '{sub(/^([^[:space:]]+[[:space:]]+){3}/,"")}1' file
-rw-r--r-- 1 waldner users 46592 2003-09-12 09:41 file1
-rw-r--r-- 1 waldner users 11509 2008-10-07 17:42 file2
-rw-r--r-- 1 waldner users 11193 2008-10-07 17:41 file3
-rw-r--r-- 1 waldner users 19073 2008-10-07 17:45 file4
-rw-r--r-- 1 waldner users 36332 2008-10-07 17:03 file5
-rw-r--r-- 1 waldner users 33395 2008-10-07 16:53 file6
-rw-r--r-- 1 waldner users 54272 2008-09-18 16:20 file7
-rw-r--r-- 1 waldner users 20573 2008-10-07 17:50 file8

It looks like sub() did nothing. Now change that to use the C locale:

$ LC_ALL=C awk --re-interval '{sub(/^([^[:space:]]+[[:space:]]+){3}/,"")}1' file
users 46592 2003-09-12 09:41 file1
users 11509 2008-10-07 17:42 file2
users 11193 2008-10-07 17:41 file3
users 19073 2008-10-07 17:45 file4
users 36332 2008-10-07 17:03 file5
users 33395 2008-10-07 16:53 file6
users 54272 2008-09-18 16:20 file7
users 20573 2008-10-07 17:50 file8

Now it works. Another localization issue is the behavior of bracket expressions matching, like for example [a-z]:

$ echo 'èòàù' | LC_ALL=en_US.utf8 awk '/[a-z]/'

This may or may not be what you want. When in doubt or when facing an apparently inexplicable result, try putting LC_ALL=C before your awk invocation.

Parse CSV

Update: Mr. Waldner just notified me that he has improved this section of the article on his website. See "CVS Parsing With Awk".

This is another thing people do all the time with awk. Simple CSV files (with fields separated by commas, and commas cannot appear anywhere else) are easily parsed using FS=','. There can be spaces around fields, and we don't want them, like eg

    field1  ,   field2   , field3   , field4

Exploiting the fact that FS can be a regex, we could try something like FS='^ *| *, *| *$'. This can be problematic for two reasons:

  • actual data field might end up correponding either to awk's fields 1 ... NF or 2 ... NF, depending on whether the line has leading spaces or not;
  • for some reason, assigning that regex to FS produces unexpected results if fields have embedded spaces (anybody knows why?).

In this case, it's probably better to parse using FS=',' and remove leading and trailing spaces from each field:

# FS=','
  gsub(/^ *| *$/,"",$i);
  print "Field " i " is " $i;

Another common CSV format is


Assuming double quotes cannot occur in fields. This is easily parsed using FS='^"|","|"$' (or FS='","|"' if you like), keeping in mind that the actual fields will be in position 2, 3 ... NF-1. We can extend that FS to allow for spaces around fields, like eg

   "field1"  , "field2",   "field3" , "field4"

by using FS='^ *"|" *, *"|" *$'. Usable fields will still be in positions 2 ... NF-1. Unlike the previous case, here that FS regex seems to work fine. You can of course also use FS=',', and remove extra characters by hand:

# FS=','
  gsub(/^ *"|" *$/,"",$i);
  print "Field " i " is " $i;

Another CSV format is similar to the first CSV format above, but allows for field to contain commas, provided that the field is quoted:

 field1, "field2,with,commas"  ,  field3  ,  "field4,foo"

We have a mixture of quoted and unquoted fields here, which cannot parsed directly by any value of FS (that I know of, at least). However, we can still get the fields using match() in a loop (and cheating a bit):

$0=$0",";                                  # yes, cheating
while($0) {
  match($0,/[^,]*,| *"[^"]*" *,/);            
  sf=f=substr($0,RSTART,RLENGTH);          # save what matched in sf
  gsub(/^ *"?|"? *,$/,"",f);               # remove extra stuff
  print "Field " ++c " is " f;
  sub(sf,"");                              # "consume" what matched

As the complexity of the format increases (for example when escaped quotes are allowed in fields), awk solutions become more fragile. Although I should not say this here, for anything more complex than the last example, I suggest using other tools (eg, Perl just to name one). Btw, it looks like there is an awk CSV parsing library here: (I have not tried it).

Pitfall: validate an IPv4 address

Let's say we want to check whether a given string is a valid IPv4 address (for simplicity, we limit our discussion to IPv4 addresses in the traditiona dotted quad format here). We start with this seemingly valid program:

awk -F '[.]' 'function ok(n){return (n>=0 && n<=255)} {exit (ok($1) && ok($2) && ok($3) && ok($4))}'

This seems to work, until we pass it '123b.44.22c.3', which it happily accepts as valid. The fact is that, due to the way awk's number to string conversion works, some strings may "look like" numbers to awk, even if we know they are not. The correct thing to do here is to perform a string comparison against a regular expression:

awk -F '[.]' 'function ok(n) {
  return (n ~ /^([01]?[0-9]?[0-9]|2[0-4][0-9]|25[0-5])$/)
{exit (ok($1) && ok($2) && ok($3) && ok($4))}'

Check whether two files contain the same data

We want to check whether two (unsorted) files contain the same data, that is, the set of lines of the first file is the same set of lines of the second file. One way is of course sorting the two files and processing them with some other tool (for example, uniq or diff). But we want to avoid the relatively expensive sort operation. Can awk help us here? The answer (you guessed it) is yes. If we know that the two files do not contain duplicates, we can do this:

awk '!($0 in a) {c++;a[$0]} END {exit(c==NR/2?0:1)}' file1 file2

and check the return status of the command (0 if the files are equal, 1 otherwise). The assumption we made that the two files must not contain duplicate lines is crucial for the program to work correctly. In essence, what it does is to keep track of the number of different lines seen. If this number is exactly equal to half the number of total input records seen, then the two files must be equal (in the sense described above). To understand that, just realize that, in all other cases (ie, when a file is only a partial subset or is not a subset of the other), the total number of distinct lines seen will always be greater than NR/2.

The program's complexity is linear in the number of input records.

Pitfall: contexts and variable types in awk

We have this file:


and we want to replace the last field with "X" only when the fourth field is not empty. We thus do this:

awk -F ',' -v OFS=',' '{if ($4) $6="X"}1'

But we see that the substitution only happens in the last line, instead of the last two as we expected. Why?

Basically, there are only two data types in awk: strings and numbers. Internally, awk does not assign a fixed type to the variables; they are literally considered to be of type "number" and "string" at the same time, with the number 0 and the null string being equivalent. Only when a variable is used in the program, awk automatically converts it to the type it deems appropriate for the context. Some contexts strictly require a specific type; in that case, awk automatically converts the variable to that type and uses it. In contexts that does not require a specific type, awk treats variables that "look like" numbers as numbers, and the other variables are treated as strings. In out example above, the simple test "if ($4)" does not provide a specific context, since the tested variable can be anything. In the first line, $4 is an empty string, so awk considers it false for the purposes of the test. In the second line, $4 is "0". Since it look like a number, awk uses it like a number, ie zero. Since 0 is considered false, the test is unsuccessful and the substitution is not performed.

Luckily, there is a way to help awk and tell it exactly what we want. We can use string concatenation and append an empty string to the variable (which does not change its value) to explicitly tell awk that we want it to treat it like a string, or, conversely, add 0 to the variable (again, without changing its value) to explicitly tell awk that we want a number. So this is how our program should be to work correctly:

awk -F ',' -v OFS=',' '{if ($4"") $6="X"}1'   # the "" forces awk to evaluate the variable as a string

With this change, in the second line the if sees the string "0", which is not considered false, and the test succeeds, just as we wanted.

As said above, the reverse is also true. Another typical problematic program is this:

awk '/foo/{tot++} END{print tot}'

This, in the author's intention, should count the number of lines that match /foo/. But if /foo/ does not appear in the input, the variable tot retains its default initial value (awk initializes all variables with the dual value "" and 0). print expects a string argument, so awk supplies the value "". The result is that the program prints just an empty line. But we can force awk to treat the variable as numeric, by doing this:

awk '/foo/{tot++} END{print tot+0}'

The seemingly innocuous +0 has the effect of providing numeric context to the variable "tot", so awk knows it has to prefer the value 0 of the variable over the other possible internal value (the empty string). Then, numeric-to-string conversion still happens to satisfy print, but this time what awk converts to string is 0, so print sees the string "0" as argument, and prints it.

Note that, if an explicit context has been provided to a variable, awk remembers that. That can lead to unexpected results:

# input: 2.5943 10
awk '{$1=sprintf("%d",$1);   # truncates decimals, but also explicitly turns $1 into a string!
      if($1 > $2) print "something went wrong!" }          # this is printed

Here, after the sprintf(), awk notes that we want $1 to be a string (in this case, "2"). Then, when we do if($1>$2), awk sees that $2 has no preferred type, while $1 does, so it converts $2 into a string (to match the wanted type of $1) and does a string comparison. Of course, 99.9999% of the times this is not what we want here. In this case, the problem is easily solved by doing "if ($1+0 > $2)" (doing $2+0 instead WON'T work!), doing "$1=$1+0" after the sprintf(), or using some other means to truncate the value of $1, that does not give it explicit string type.

Pulling out things

Suppose you have a file like this:

Yesterday I was walking in =the street=, when I saw =a
black dog=. There was also =a cat= hidden around there. =The sun= was shining, and =the sky= was blue.
I entered =the
shop= and I bought two CDs. Then I went to =the cinema= and watched =a very nice movie=.
End of the story.

Ok, silly example, fair enough. But suppose that we want to print only and all the parts of that file that are like =something=. We have no knowledge of the structure of the file. The parts we're interested in might be anywere; they may span lines, or there can be many of them on a single line. This seemingly daunting and difficult task is actually easily accomplished with this small awk program:

awk -v RS='=' '!(NR%2)'
# awk -v RS='=' '!(NR%2){gsub(/\n/," ");print}'    # if you want to reformat embedded newlines

Easy, wasn't it? Let's see how this works. Setting RS to '=' tells awk that records are separated by '=' (instead of the default newline character). If we look at the file as a series of records separated by '=', it becomes clear that what we want are the even-numbered records. So, just throw in a condition that is true for even-numbered records to trigger the printing.

GNU awk can take this technique a step further, since it allows us to assign full regexes to RS, and introduces a companion variable (RT) that stores the part of the input that actually matched the regex in RS. This allows us, for example, to apply the previous technique when the interesting parts of the input are delimited by different characters or string, like for example when we want everything that matches <tag>something</tag>. With GNU awk, we can do this:

gawk -v RS='</?tag>' 'RT=="</tag>"'

or again

gawk -v RS='</?tag>' '!(NR%2)'

and be done with that. Another nice thing that can be done with GNU awk and RT is printing all the parts of a file that match an arbitrary regular expression (something otherwise usually not easily accomplished). Suppose that we want to print everything that looks like a number in a file (simplifiying, here any sequence of digits is considered a number, but of course this can be refined), we can do just this:

gawk -v RS='[0-9]+' 'RT{print RT}'

Checking that RT is not null is necessary because for the last record of a file RT is null, and an empty line would be printed in that case. The output produced by the previous program is similar to what can be obtained using grep -o. But awk can do better than that. We can use a slight variation of this same technique if we want to add context to our search (something grep -o alone cannot do). For example, let's say that we want to print all numbers, but only if they appear inside "--", eg like --1234--, and not otherwise. With gawk, we can do this:

gawk -v RS='--[0-9]+--' 'RT{gsub(/--/,"",RT);print RT}'

So, a carefully crafted RS selects only the "right" data, that can be subsequently extracted safely and printed.

With non-GNU awk, matching all occurrences of an expression can still be done, it just requires more code. See FindAllMatches.

Have fun!

Have fun learning Awk! It's a fun language to know.

Ps. I will go silent for a week. I have an on-site interview with Google in Mountain View, California. I'll be back on 31st of October and will post something new in the first week of November!


Unix User Permalink
October 24, 2008, 00:20

Something I often need to do is match lines against a regexp, and print out a matching group within that line. But I have never been able to find a way to do this in awk, and end up resorting to Perl.

So - is there a way to do something like this?

/abc([0-9]+)def/ { print group(1); }

so that input of:





September 19, 2011, 07:32

you can install gawk,and do like this:
gawk 'mathc($0,regex,array){print array[1]}' file

gawk 'match($0, "https?:\/\/(.*?google.*?)/", array) {print array[1]}' filename

waldner Permalink
October 24, 2008, 08:57

Unix User:

That is easily done with gawk, see the last tip. You could do eg

gawk -v RS='abc([0-9]+)def' 'RT{gsub(/[^0-9]/,"",RT)print RT}

Of course, the exact regexes used for RS and in the gsub vary from time to time depending on what you want to achieve. Another solution is using gensub(), again from gawk.

Unfortunately, standard awk regexes lack backreferences, so getting what you want using standard awk would not be easy. Permalink
October 09, 2014, 16:01

but less wordy in perl :

perl -le 'shift =~ /(\d+)/;print $1' abc123def Permalink
October 09, 2014, 16:04

or even

perl -le 'print shift =~ /(\d+)/' abc123def

waldner Permalink
October 24, 2008, 11:39

To pkrumins: something got lost during reformatting. The first two examples that uses GNU awk and RT should be as follows:

" for example when we want everything that matches something. With GNU awk, we can do this:

gawk -v RS='' 'RT==""'

or again

gawk -v RS='' '!(NR%2)'
waldner Permalink
October 24, 2008, 11:40

ok, now I see :-)

Let's see it this time it works:

" for example when we want everything that matches <tag>something</tag>. With GNU awk, we can do this:

gawk -v RS='</?tag>' 'RT=="</tag>"'

or again

gawk -v RS='</?tag>' '!(NR%2)'

waldner Permalink
October 24, 2008, 15:29


no, using int(n)==n to check if a number is valid in an IPv4 address won't work. It will accept, for example, "+100" which is not valid in a dotted quad IPv4 address.

Thorsten Strusch Permalink
October 24, 2008, 23:43

@Unix User:
tr should be the tool of your choice:

 echo "abc654dEF" | tr -d 'a-zA-Z'
zts Permalink
October 25, 2008, 02:22

Alternate solution for the IP address validation function:

function ok(n){ return (n !~ /[^0-9]/) && (n>=0 && nThis just adds an additional test to assert that the value being tested contains only numeric characters.
zts Permalink
October 25, 2008, 02:25

(I'll try that again) Alternate solution for the IP address validation function - same as your first suggestion, but with a condition allowing only numeric values:

function ok(n){ return (n !~ /[^0-9]/) && (n>=0 && n
October 25, 2008, 14:01

Keep us updated with what goes there at Mt. View, CA :D

Good luck newbie googler (Y)

October 25, 2008, 19:58

Found this site due to the article you wrote on perl one-liner youtube downloader (which no longer works) and I see you've digressed. Why would anyone go from perl to awk? Did you hit your head?

waldner Permalink
October 27, 2008, 18:27


That's a good one! Thank you.


I agree perl is more powerful of awk. But I think you'll agree that that is not a valid reason to stop using awk (or sed, or cat, or all the other tools that perl could easily replace).

Steve Kinoshita Permalink
October 29, 2008, 03:13


This is a really helpful article thanks!

I am trying to remove all double quotes and angled brackets, and replcase all semicolons and colons with newlines in a text file with gawk.

Can you help?

I have trouble making my scripts work.
I use gawk3.1.6 for Windows and following are some of the codes I have tried.

awk {gsub(/,/,"\n")}1 
awk {gsub(/\"/,"")}1 
waldner Permalink
October 29, 2008, 14:28

@Steve Kinoshita:

To remove all double quotes and angled brackets, try this:


To replace all semicolons and colons with newlines, try this:


Since you say you're using windows, I suggest you put your awk program in a separate file, and then run it using

awk -f prog.awk yourfile
November 03, 2008, 01:22

In "Pitfall: validate an IPv4 address" awk returns not-zero when the input is a valid IPv4 address and zero otherwise. That's because awk's boolean arithmetic assigns 1 to True and 0 to False.

This is not what a shell programmer would expect because shells usually act in the opposite way: true=0 and false=1.

Thus, the final "shell-compatible" script should be:

awk -F '[.]' 'function ok(n) {
  return (n ~ /^([01]?[0-9]?[0-9]|2[0-4][0-9]|25[0-5])$/)
{exit (! ( ok($1) && ok($2) && ok($3) && ok($4) ) )}'

However, I'd prefer to use something simpler:

function ok(n) {if (n ~ /[^[:digit:]]/)        return 1==0;return (nNot fully tested but should work the samemy 2 pennies ;)
waldner Permalink
November 03, 2008, 11:55

@Marco R:

Awk's logic is not broken. I just follows the C (and many other languages) model, where any nonzero value is considered true, so you can do
"if <something> then ...".

The shell uses the same logic, but it just uses zero to indicate success and nonzero to indicate failure, but that's not necessarily a bad thing.

In the particular application of validating an address, the return value depends on the context you'll use that. If the function ok() is to be invoked within the awk program only, then I think returning 1 for success makes sense (and perhaps return 0 at the end of the overall awk program if it succeeded in its entirety). If, on the other hand, you want to use the awk program directly from the shell, only to check IP addresses, then you can return 0 for success, as you suggest. I think it's a matter of personal taste after all.

Regarding the function ok() you suggest, something similar was proposed by another reader (see previous comments). However, I don't see the point in returning "1==0" instead of simply 0.

Thanks for your comment!

karl Permalink
November 07, 2008, 09:21

It's easy with sed:

echo abc654def | sed -E -n -e 's/abc([0-9]+)def/\1/p'

Rob Permalink
November 10, 2008, 18:32


Thank you for the tips.

Could I ask something basic? If I have an IP= how do I use the 'Pitfall: validate an IPv4 address' to validate the variable/input?


waldner Permalink
November 10, 2008, 22:41


many solutions have been proposed in the article and in the comments. To summarize, you can build a function that accepts an argument and checks if that argument is a number and is between 0 and 255, and use that function to check that all four octets are valid. The skeleton of a program is as follows:

awk -F[.] '
function ok(n) {
 # do something here to check the value of n,
 # and return 1 if it's valid, 0 otherwise
{exit ( ok($1) && ok($2) && ok($3) && ok($4) )'

(to make it more robust, you may optionally check that the number of input fields (ie, octets) is exactly 4, no more and no less)
so you will call it as follows, for example:

echo "" | awk -F[.] '...'
if [ $? -eq 1 ]; then
   echo "valid IP address"
   echo "invalid IP address"

where the part '...' is the complete awk program.
Note that, to follow shell conventions, you may choose to have the awk program return 0 on success and 1 on failure instead.

That said, here are two ways to implement function ok:

function ok(n) {
  # string check using a regex
  return (n~/^([01]?[0-9]?[0-9]|2[0-4][0-9]|25[0-5])$/)

function ok(n) {
  # check that n is a number, and then that
  # it is in the range 0-255
  return (n~/^[0-9]*$/ && n>=0 && n<=255)

Again, you might choose to negate the return values if you want to return 0 on success.

November 17, 2008, 08:18

Really great way to explain things and reading it makes me humble too

Thank you guys !

December 11, 2008, 23:12

I read the article but can not figure out how to get awk to print the lines of a file, minus the duplicates. For example I have a file with a bunch of IP addresses some of which are duplicated throughout the file. I am only interested in having the output display unique IP addresses. any ideas?

December 11, 2008, 23:23

joe, it's really simple (you won't believe it):

awk '!a[$0]++'
krishna Permalink
May 11, 2010, 04:14

yes it works like a magic,, It appears to have to same effect as $>cat


| uniq
How does awk work here,, can someone explain?

February 19, 2009, 01:02

How can I search a file for a pattern ($3 in input line) and for a match print $1 and $2 and $3, but for no match print "na " "na " $3?

February 19, 2009, 09:34

Ed, easy:

$ awk '$3 ~ /pattern/ { print $1, $2, $3 } $3 !~ { print "na", "na", $3 }'


$ awk '$3 ~ /pattern/ { print $1, $2, $3; next } { print "na", "na", $3 }'


$ awk '{ if ($3 ~ /pattern/) { print $1, $2, $3 } else { print "na", "na", $3 } }'
May 02, 2009, 16:34

Just wanted to let you know that this article provides a solution for a problem I've faced for the last couple of hours. Great work and thanks to you!

Javier Permalink
March 10, 2010, 18:05

Hi everybody,

I've a file that looks like:

0 0 0 0 0 0
87 62 90 180 1.40679 1.60570860e-01
0 0 0 0 0 0
88 62 89 179 1.39871 1.76044390e-01
0 0 0 0 0 0
88 64 86 172 1.34657 1.50280803e-01
0 0 0 0 0 0
87 63 88 176 1.38235 1.94590941e-01
0 0 0 0 0 0
116 45 64 129 1.01130 1.18465826e-01
88 63 87 175 1.36837 1.46118164e-01
0 0 0 0 0 0
87 61 93 187 1.46723 1.99260086e-01

The lines containing 0's can be thought as being delimiters. I need to find between the each pair of delimiters, which line has the highest value in the last column and return it for further processing. Does anybody could shed some light on it?

Best regards,

marco Permalink
June 22, 2010, 12:51

great page...

might and in an (NF==4) to the IP address validation exit logic.

AwkNewbie Permalink
October 03, 2010, 21:24

Great awk tips. Now I have a question. What should be the command if I want to delete a range pattern, ie. if I want to delete all the lines from [Pattern2] to the first blank line for the file given below:

Some lines
Goes here

Some more lines

Goes on...

Kundan Permalink
March 07, 2011, 18:42

I have input file which has data somewhat line this, call details are in a XML file. Each call data ends with "

Joe B Permalink
June 10, 2011, 18:45

Very useful article and comments!

I have my own awk dilemma...

I'm trying to identify (and print) records from a file where the 15th & 16th bytes of a record = '02'. I've been searching for a solution but it appears most awk commands of this type reference a field $1, $2, etc.

Any ideas on how to write this? The file contains several layouts and for these specific records they are fixed length.

IF_Rock Permalink
September 23, 2011, 20:18

String constants set using apostrophes in gawk?

Amiya Permalink
October 26, 2011, 12:02

Hi All,
Can you please tell me the awk command to collect 10 lines after the search pattern.


Jotne Permalink
August 14, 2013, 07:39

Print 2 lines before and 3 after "pattern"

awk '{a[NR]=$0} $0~s {f=NR} END {for (i=f-B;i<=f+A;i++) print a[i]}' B=2 A=3 s="pattern"<\code>
grep -A3 -B2 "pattern"<\code>

Sheetal Permalink
May 17, 2016, 06:23

Hi Jotne,

I have used the below command to search for a pattern and remove the 5 lines before and 7 lines after the pattern:

awk '/pattern/{for(x=NR-5;x<=NR+7;x++)d[x];}{a[NR]=$0}END{for(i=1;i<=NR;i++)if(!(i in d))print a[i]}' filename

This is working as expected.

But I was not clear on the logic used.

Would you be able to help me understand the logic?


Amiyaranjan Sahoo Permalink
December 22, 2011, 12:28

Hi All,
Can you please tell me how to print 10 lines after/before the search string in HP UX.


February 02, 2012, 11:07

Thanks for the post. A worth reading article on awk.

pecival Permalink
July 23, 2012, 19:03

you said
awk '{sub(/pattern/,"foobar")}1'
is the equivalent to
sed 's/pattern/foobar/'

..not exactly..AFAIK the sed part should have /g to apply the replace to all matches (not just the first one)..It's just a detail, but let's be precise ;)

(I hope I'm not saying nonsense)

ohno Permalink
April 03, 2013, 11:08

AFAIK gsub() would be the equivalent to s///g. sub() only substitutes the first occurence.

Jotne Permalink
November 25, 2012, 10:56

awk '/foo/ || /bar/'

more simple

awk '/foo|bar/'

Vadim Bogulean Permalink
March 02, 2013, 09:15

Hi and thanks for your tips.
I was actually looking a way to print certain number of lines after searching a line in a file.

Based on the tips from 'Print lines using patters' I could elaborate one for my needs. Thought you could add it as well for others.

awk "{cnt-=1;if(cnt<=0)p=0;}/$1/{p=1;cnt=$2}p" $3

where $1, $2 $3 to be replaced with :
$1 - Your search pattern,
$2 - Number of lines to display (including searched pattern)
$3 - Your input file

$ awk "{cnt-=1;if(cnt<=0)p=0;}/Error:/{p=1;cnt=2}p" file

file content:
Error # 1
Warning # 2
Error # 3

Result would be:
Error # 1
Error # 3

sabith Permalink
April 16, 2013, 04:36

I have two folders named 'check' in two places. Both will have same folders but the files of each folder may differs. I want to run a script to find the difference between the folders with same name in each 'check' folder then I have to redirect the difference to a file. Please anyone help me..

colossus Permalink
October 02, 2013, 02:44

"""eg, if "FOO5\nFOO6" is found, the file "out5" will not be created"""
should be "out6" will not be created, right?

mug896 Permalink
December 30, 2013, 01:30

how about this one for IPv4 check

awk -F '[.]' 'function ok(n) {
if (n ~ /^[0-9][0-9]?[0-9]?$/) {
return (n>=0 && n<=255)
{exit (ok($1) && ok($2) && ok($3) && ok($4))}'

mug896 Permalink
December 30, 2013, 03:35

awk '!($0 in a) {c++;a[$0]} END {exit(c==NR/2?0:1)}' file1 file2

is not working..
test with this file contents

$ cat d3.txt

$ awk '!($0 in a) {c++;a[$0]} END {print(c==NR/2?0:1)}' d3.txt d3.txt
1 <---- return 1 not 0 !!!

CKP Permalink
April 28, 2014, 14:30

I have an input file "myfile" and a shell variable "VAR" whose
contents are shown below:

# cat myfile
Hello World
Hello Universe
# echo $VAR

I need to process all lines in "myfile" which contains pattern "World"
using awk. It works if i do as shown below:

# awk '/World/ { print $0 }' myfile

But i could not use VAR to do the same operation. I tried the
following even knowing that these will not work:

# awk '/$VAR/ { print $0 }' myfile


# awk -v lvar=$VAR '/lvar/ { print $0 }' myfile


# awk -v lvar=$VAR 'lvar { print $0 }' myfile

Please let me know how to match the contents of VAR in awk.

Thanks in advance

Curtis Wilbar Permalink
May 07, 2014, 16:21

This will work:

awk -v lvar="${VAR}" 'match($0, lvar) { print $0 }' myfile

October 14, 2014, 13:03

In the section "Check whether two files contain the same data", there is the claim that the awk solution is O(n). However, this is dependent on the associative array entry creation and lookup being amortised O(1). Surprisingly many utilities don't use such associative arrays but instead have O(n) behaviour for sufficiently large data. This can be caused by e.g. static hashtables or hashtables that resize by a constant amount.

If the hashtable implementation _is_ good, then the solution's linearity depends on loading all data into memory. If insufficient memory is available, sort is often a faster alternative. However, this depends on many factors.

sushma Permalink
April 04, 2016, 15:10

I have 3 block data with start and end time(Process Begining and Proces Ending). I need to discard 2 block data (sql extract) and get start and end time for one remaining

log file looks like this
Process Beginning - 2016-04-02-00.36.13

Putting Files To daADadD for File will move to /sadafJJHFASJFFASJ/

Extract Files :-/ASFDSHAF_ABC_2016-04-02.csv /ASFDSHAF_ABC.2016-04-02.csv / ASFDSHAF_ABC.2016-04-02.csv /ASFDSHAF_ABC.2016-04-02.csv /

Process Ending - 2016-04-02-00.36.36

Process Beginning - 2016-04-02-10.01.20

Putting Files To daADadD for File will move to /sadafJJHFASJFFASJ/

Extract Files :-/sdshsdhsh_cvb.2016-04-02.csv /sqlextract.2016-04-02.csv /sqlextract.2016-04-02.csv

Process Ending - 2016-04-02-10.01.21

Karthick Permalink
October 06, 2016, 11:51

I have a log like below .

pairing.releaser#001(126912) 2016/10/06 10:21:27 -FKSPT- {2:2} Write on UKFIR1P2:TSS_MTHIGH_Q.STS[native]


unknown, id => (2)"-1", reference => (16)"5545552600101647", relatedref => (16)"SCBLAD7702SCBLBM", message_id => (28)"161006SCBLBHBMXXXX0068990683", system_id => (30)"MTH20161006102056-01807-144959", userref => (16)"OEE0610164968810", pairing_id => (0)"")>
pairing.releaser#001(126912) 2016/10/06 10:21:27 -INFOS- {2} qput:MQSTATUS[UKFIR1P2:TSS_MTHIGH_Q.STS]: descriptor


(24)"AMQ QM.MPS.LIV \r\x92i\x07\x1A\xDB~\x81", identity => (0)"")> and buffer


pairing.releaser#001(126912) 2016/10/06 10:21:27 -INFOS- {1:2} ============================================================
pairing.releaser#001(126912) 2016/10/06 10:21:27 -INFOS- {1:2} == Activity statistics for pairing.releaser#001(126912)
pairing.releaser#001(126912) 2016/10/06 10:21:27 -INFOS- {1:2} ============================================================
pairing.releaser#001(126912) 2016/10/06 10:21:27 -INFOS- {1:2} Deleted 4 checksum(s) (bu:ROOT) in database
pairing.releaser#001(126912) 2016/10/06 10:21:27 -INFOS- {1:2} Routed 4 message(s) (0/(6)"NO HIT"/ROOT/BH/STAR0027) to UKFIR1P2:TSS_MTHIGH_Q.STS[native]
pairing.releaser#001(126912) 2016/10/06 10:21:27 -INFOS- {1:2} Poped 4 message(s) from retention
pairing.releaser#001(126912) 2016/10/06 10:21:27 -INFOS- {1:2} Released 4 individual message(s) (bu:ROOT)
pairing.releaser#001(126912) 2016/10/06 10:21:27 -INFOS- {1:2} 048ms / 83.486 TPS
pairing.releaser#001(126912) 2016/10/06 10:21:27 -INFOS- {1:2} ============================================================

When i pass the message id "SCBLAD7702SCBLBM" i need to get the line i pasted above. Please help me with the command.

andrea Permalink
January 15, 2018, 11:31

Fantastic WriteUp , thanks a million
found this , maybe ...
awk -v n=1 '/^FOO[0-9]*/{close("out"n);n++;next} {print > "out"n}' file
should be?
awk -v n=1 '/^FOO[0-9]*/{close("out"n);n++;next} {print > ("out"n)}' file

to avoid
print > >>> "out"n <<<
awk: illegal statement at source line 1

Leave a new comment

(why do I need your e-mail?)

(Your twitter handle, if you have one.)

Type the word "cloud_100": (just to make sure you're a human)

Please preview the comment before submitting to make sure it's OK.