Overview
find, grep, awk, and sed are the four corners of Unix text processing. This card collects the expressions worth knowing, with the escaping and portability gotchas inline. For parameter expansion and pure-bash alternatives, see bash-one-liners.
find
Search the filesystem before you rename, delete, or pipe.
| Expression | What it does |
|---|---|
find . -type f -name '*.md' | All Markdown files, recursive. |
find . -type d -name __pycache__ | Directories named __pycache__. |
find . -type f -size +10M | Files larger than 10 MB. |
find . -type f -mtime -7 | Files modified in the last 7 days. |
find . -type f -newer ref.txt | Files newer than ref.txt. |
find . -type f -name '*.log' -delete | Delete matched files in one pass. |
find . -type f -name '*.tmp' -exec rm {} + | Same, batched for fewer rm invocations. |
find . -not -path '*/node_modules/*' | Exclude a subtree. |
find . -type f \( -name '*.ts' -o -name '*.tsx' \) | Multiple name patterns with OR. |
find . -type f -name '*.md' -print0 | xargs -0 wc -l | Safe pipeline for filenames with spaces. |
find . -mindepth 2 -maxdepth 3 -type f | Depth-bounded search. |
find . -type d -empty -delete | Remove empty directories. |
Use -print0 | xargs -0 when filenames may contain spaces, newlines, or quotes.
grep
Match patterns in files; use the right engine for the job.
| Flag or expression | What it does |
|---|---|
grep "pattern" file.txt | Basic search; print matching lines. |
grep -r "pattern" . | Recursive search from current directory. |
grep -rn "pattern" . | Recursive with line numbers. |
grep -rI "pattern" . | Skip binary files. |
grep -l "pattern" ./*.md | Print only filenames, not matching lines. |
grep -L "pattern" ./*.md | Files that do NOT match. |
grep -c "pattern" file | Count matching lines. |
grep -v "pattern" file | Invert match; print non-matching lines. |
grep -i "pattern" file | Case-insensitive. |
grep -w "word" file | Whole-word match. |
grep -A 3 -B 2 "pattern" file | 3 lines after, 2 lines before each match. |
grep -E "(foo|bar)" file | Extended regex; equivalent to egrep. |
grep -P "\d{3}-\d{4}" file | PCRE (not portable; GNU grep only). |
grep -o "pattern" file | Print only the matched portion. |
Prefer rg (ripgrep) over grep -r for speed and .gitignore awareness.
awk
awk is a field-oriented language; use it for columnar data.
| Expression | What it does |
|---|---|
awk '{print $1}' file | Print first field (default delimiter: whitespace). |
awk '{print $NF}' file | Print last field. |
awk -F: '{print $1}' /etc/passwd | Set field delimiter to :. |
awk 'NR==5' file | Print line 5. |
awk 'NR>=3 && NR<=7' file | Print lines 3 to 7. |
awk '/pattern/' file | Print lines matching a regex. |
awk '!/pattern/' file | Print lines not matching. |
awk '{sum += $2} END {print sum}' file | Sum column 2. |
awk 'BEGIN {FS=","} {print $1, $3}' file.csv | CSV with explicit FS. |
awk '{print $2, $1}' file | Swap columns 1 and 2. |
awk 'length($0) > 80' file | Lines longer than 80 characters. |
awk '!seen[$0]++' file | Remove duplicate lines (preserving order). |
awk '{gsub(/old/, "new"); print}' file | Global substitution in each line. |
awk is ideal for log parsing and CSV reshaping when you need field access rather than full regex substitution.
sed
sed edits streams line by line; use it for substitution, deletion, and insertion.
| Expression | What it does |
|---|---|
sed 's/old/new/' file | Replace first occurrence per line. |
sed 's/old/new/g' file | Replace all occurrences per line. |
sed -i 's/old/new/g' file | In-place edit (GNU sed; Linux). |
sed -i '' 's/old/new/g' file | In-place edit (BSD sed; macOS). |
sed -i.bak 's/old/new/g' file | In-place with backup; portable. |
sed '/pattern/d' file | Delete lines matching a pattern. |
sed -n '/start/,/end/p' file | Print lines between two patterns. |
sed -n '10,20p' file | Print lines 10 to 20. |
sed '1d' file | Delete the first line (header removal). |
sed '$d' file | Delete the last line. |
sed 's/^/PREFIX: /' file | Prepend to every line. |
sed 's/$/ SUFFIX/' file | Append to every line. |
sed '/pattern/a\new line' file | Append a line after each match (GNU sed). |
Common pipelines
Combine the tools for real-world tasks.
| Pipeline | What it does |
|---|---|
find . -name '*.log' | xargs grep -l "ERROR" | Find log files that contain “ERROR”. |
grep -rn "TODO" . | awk -F: '{print $1}' | sort -u | Files containing TODOs, deduplicated. |
find . -name '*.md' -exec grep -l "deprecated" {} + | Markdown files with the word “deprecated”. |
grep -r "old_function" . --include='*.py' -l | xargs sed -i 's/old_function/new_function/g' | Rename a function across Python files. |
awk '{print $1}' access.log | sort | uniq -c | sort -rn | head -10 | Top 10 IPs in an access log. |
sed -n '/\[ERROR\]/,/\[INFO\]/p' app.log | Extract error blocks. |
find . -name '*.ts' -print0 | xargs -0 grep -l "console.log" | xargs sed -i '/console\.log/d' | Remove console.log from TypeScript files. |
Common gotchas
sed -iis GNU;sed -i ''is BSD. Usesed -i.bakfor portable in-place editing; then remove*.bakwithfind . -name '*.bak' -delete.find . -name '*.md' -exec cmd {} ;runscmdonce per file. Use+instead of;to batch files and reduce subprocess overhead.- Unquoted globs in
-nameare expanded by the shell beforefindsees them. Always quote the pattern:-name '*.md', not-name *.md. grep -rfollows symlinks and entersnode_modulesunless you pass--exclude-dir=node_modules. Usergto avoid this.awk '{print $1}'uses whitespace as the delimiter. A CSV with spaces inside quoted fields will be split incorrectly. Set-F","and handle quotes explicitly or use a proper CSV tool.sed 's/./X/g'replaces every character;.is a regex metacharacter. Escape it as\.to match a literal dot.grep -P(PCRE) is available in GNU grep but not in BSD grep. Use-Efor ERE patterns to stay portable.