awk Cheat Sheet

1. Mental model

2. Quick start

awk 'pattern { action }' file
awk 'BEGIN { setup } pattern { action } END { summary }' file

ps aux | awk '$3 > 20 { print $2, $3, $11 }'
git log --oneline | awk '{ print NR ": " $0 }'

3. Invocation and options

Passing variables

min=100
awk -v min="$min" '$3 >= min { print $1, $3 }' file

Multiple input files

awk '{ print FILENAME, FNR, $0 }' *.log
awk 'FNR == 1 { print "== " FILENAME " ==" } { print }' *.txt

4. Records and fields

A record is normally one line. A field is normally one whitespace-separated token. Change RS for records and FS for fields.

Separators

awk -F: '{ print $1 }' /etc/passwd
awk 'BEGIN { FS="[,:]" } { print $1, $2 }' file
awk 'BEGIN { FS="\t"; OFS="," } { print $1, $3 }' table.tsv

Changing fields rebuilds the record

awk 'BEGIN { OFS="," } { $2 = toupper($2); print }' file
awk '{$1=$1; print}' file

5. Patterns and actions

An awk program is a sequence of pattern { action } rules. A missing pattern means every record. A missing action means print.

Common filters

awk 'NF' file
awk 'NF == 0' file
awk '$1 == "GET" && $9 >= 500' log
awk 'NR >= 10 && NR <= 20' file
awk 'FNR == NR { ids[$1]; next } $1 in ids' allowlist data

6. Regular expressions

Regex functions

awk '{ sub(/old/, "new"); print }' file
awk '{ gsub(/[[:space:]]+/, " "); print }' file
awk 'match($0, /id=[0-9]+/) { print substr($0, RSTART, RLENGTH) }' log

7. Variables and built-ins

Variables spring into existence when used. Uninitialized variables behave like an empty string or numeric zero depending on context.

awk '{ total += $2; seen = 1 } END { print total }' file
awk -v label="Total" '{ sum += $1 } END { print label, sum }' file

awk '$1 + 0 > 10' file
awk '$1 "" == "0012"' file

awk 'BEGIN { print ENVIRON["HOME"] }'
awk -v user="$USER" 'BEGIN { print user }'

8. Operators

9. Arrays

awk arrays are associative maps. Indexes are strings, even when they look numeric.

awk '{ count[$1]++ }
END { for (key in count) print key, count[key] }' file

awk 'FNR == NR { keep[$1]; next }
$1 in keep { print }' ids.txt data.txt

awk '{ seen[$1]++ }
END { delete seen["tmp"]; for (k in seen) print k }' file

Composite keys

awk '{ count[$1, $2]++ }
END {
  for (key in count) {
    split(key, parts, SUBSEP)
    print parts[1], parts[2], count[key]
  }
}' file

Sorting output

awk '{ count[$1]++ } END { for (k in count) print k, count[k] }' file | sort
gawk 'BEGIN { PROCINFO["sorted_in"] = "@ind_str_asc" }
{ count[$1]++ } END { for (k in count) print k, count[k] }' file

10. Control flow

Multi-rule flow

awk '
NR == 1 { next }
$3 == "" { missing++; next }
$3 >= 90 { print $1, "pass"; next }
{ print $1, "review" }
END { print "missing:", missing }
' scores.tsv

11. Functions

User-defined functions

awk '
function pct(part, whole) {
  return whole ? (part * 100 / whole) : 0
}
{ used += $2; total += $3 }
END { printf "%.1f%%\n", pct(used, total) }
' file

12. Input and output

Split records into files

awk '{ print > ($1 ".txt"); close($1 ".txt") }' file

Read a lookup file manually

awk 'BEGIN {
  while ((getline line < "names.txt") > 0) {
    split(line, parts, "\t")
    name[parts[1]] = parts[2]
  }
  close("names.txt")
}
{ print $1, name[$1] }' ids.txt

13. Formatting output

Use print for simple separated fields and printf for aligned reports, fixed decimals, zero padding, and custom layouts.

Report layout

awk '
BEGIN { printf "%-20s %10s\n", "name", "bytes" }
{ total += $2; printf "%-20s %10d\n", $1, $2 }
END { printf "%-20s %10d\n", "TOTAL", total }
' sizes.tsv

14. CSV and structured data

awk -F, 'BEGIN { OFS="," } NR > 1 { print $1, $4 }' file.csv

gawk --csv 'NR > 1 { print $2 }' file.csv

jq -r '.items[] | [.name, .size] | @tsv' data.json | awk '{ sum += $2 } END { print sum }'

15. Shell integration

Safe shell variable pattern

needle='a value with spaces'
awk -v needle="$needle" '$0 == needle { print NR }' file

Shell function wrapper

top_statuses() {
  awk '{ count[$9]++ } END { for (s in count) print count[s], s }' "$@" | sort -nr
}

16. Script files

Move longer awk programs into .awk files when quoting, indentation, or reuse starts to matter.

awk -f report.awk data.tsv
awk -v min=100 -f filter.awk data.tsv

#!/usr/bin/awk -f
BEGIN { FS = "\t"; OFS = "\t" }
NR > 1 { print $1, $3 }

Readable report script

BEGIN {
  FS = "\t"
  OFS = "\t"
}

NR == 1 {
  next
}

{
  rows++
  total += $3
  by_team[$2] += $3
}

END {
  print "rows", rows
  print "total", total
  for (team in by_team) {
    print team, by_team[team]
  }
}

17. Recipes

Access log summary

awk '{
  status[$9]++
  bytes += $10
}
END {
  for (s in status) print s, status[s]
  print "bytes", bytes
}' access.log

Find slow requests

awk -v threshold=1.0 '$NF > threshold { print $1, $7, $NF }' access.log

18. Portability and gotchas