AWK Quick Reference

A fast, practical cheat sheet for daily sysadmin, DevSecOps, log analysis, and automation work. Clean, minimal, and designed for rapid recall.

Mental Model (Quick Recall)

awk 'pattern { action }' file

pattern

When to run the action

action

What to do (default: print $0)

$1, $2 ... $NF

Individual fields

$0

Whole line

Key Variables

NR → global line number
NF → number of fields

Common One-Liners (Daily Use)

Print field(s)

awk '{ print $2 }' file

Extracts the second field from each line.

Prefix output

awk '{ print "ll  "$2 }' /etc/fstab

Adds a prefix to field output for better readability.

Print mountpoints only

df -h | awk 'NR>1 { print $NF }'

Skips the header line and prints the last field (mountpoint).

Skip comments + blank lines

awk '!/^#/ && NF { print $0 }'

Filters out comments (lines starting with #) and blank lines.

Filter rows by value

awk '$3 == "ext4"' /etc/fstab

Shows only lines where the third field equals “ext4”.

Lines matching regex

awk '/error/ { print }' /var/log/app.log

Prints lines containing the word “error”.

Field Separators (FS)

awk -F":" '{ print $1 }' /etc/passwd

Use -F to specify custom field separators. Multiple delimiters can be specified using regex patterns.

Output Formatting (OFS)

Change output separator

awk 'BEGIN { OFS="," } { print $1, $2 }' file

Outputs fields separated by commas instead of spaces.

Pretty formatting with printf

awk '{ printf "%-20s %s\n", $1, $2 }'

Left-aligns first field in 20-character column.

Arithmetic & Aggregation

Sum a column

awk '{ sum+=$2 } END { print sum }'

Adds up all values in the second field.

Count lines

awk 'END { print NR }'

Returns total number of lines processed.

The END block executes after all input lines have been processed, making it perfect for aggregations.

Conditionals

awk '{ if ($3 > 10) print $0 }'

Key Built-in Variables

Variable	Meaning
`$0`	entire line
`$1..$NF`	fields
`NF`	number of fields
`NR`	line number (global)
`FNR`	line number per file
`FS`	field separator
`OFS`	output field separator
`RS`	record separator
`ORS`	output record separator

Useful Practical Snippets

Remove duplicate lines

awk '!seen[$0]++' file

Keeps only the first occurrence of each unique line.

Extract column and transform

awk '{ print toupper($1) }'

Converts first field to uppercase.

Replace text inline

awk '{ gsub("old","new"); print }'

Replaces all occurrences of “old” with “new” in each line.

Print field indexes (debug)

awk '{ for (i=1;i<=NF;i++) print i, $i }'

Shows field number and value for debugging.

Real Sysadmin Examples

Always test AWK commands on sample data before running on production logs or system files.

Parse fstab quickly

awk '!/^#/ && NF { print $1, $2, $3 }' /etc/fstab

Skips comments and blank lines, shows device, mountpoint, and filesystem type.

Extract blocked IPs from logs

awk '/DENIED/ { print $NF }' firewall.log

Finds all “DENIED” entries and prints the last field (typically the IP).

Show failed SSH attempts

awk '/Failed password/ { print $(NF-3) }' /var/log/auth.log

Extracts IP addresses from failed SSH login attempts.

Minimal Recall Table

Concept	Shortcut
Fields	`$1..$NF`
Whole line	`$0`
Line number	`NR`
Filter rows	`condition { print }`
Set delimiter	`-F","`
Format output	`printf`
Pre/Post blocks	`BEGIN` / `END`

Bookmark this table for quick reference during incident response or log analysis.

Quick Reference

Compliance & Security

Prompt Engineering

Repository Info

Mental Model (Quick Recall)

pattern

action

$1, $2 ... $NF

$0

Key Variables

Common One-Liners (Daily Use)

Field Separators (FS)

Output Formatting (OFS)

Arithmetic & Aggregation

Conditionals

Key Built-in Variables

Useful Practical Snippets

Real Sysadmin Examples

Parse fstab quickly

Extract blocked IPs from logs

Show failed SSH attempts

Minimal Recall Table

Build docs developers (and LLMs) love

Quick Reference

Compliance & Security

Prompt Engineering

Repository Info

​Mental Model (Quick Recall)

pattern

action

$1, $2 ... $NF

$0

​Key Variables

​Common One-Liners (Daily Use)

​Field Separators (FS)

​Output Formatting (OFS)

​Arithmetic & Aggregation

​Conditionals

​Key Built-in Variables

​Useful Practical Snippets

​Real Sysadmin Examples

​Parse fstab quickly

​Extract blocked IPs from logs

​Show failed SSH attempts

​Minimal Recall Table

Build docs developers (and LLMs) love

Mental Model (Quick Recall)

Key Variables

Common One-Liners (Daily Use)

Field Separators (FS)

Output Formatting (OFS)

Arithmetic & Aggregation

Conditionals

Key Built-in Variables

Useful Practical Snippets

Real Sysadmin Examples

Parse fstab quickly

Extract blocked IPs from logs

Show failed SSH attempts

Minimal Recall Table