awk, one lesson per page
Thirty lessons for the pattern scanning and processing language already on every Unix: patterns and actions, fields and separators, BEGIN and END, associative arrays, printf columns, and the classic report and pivot one-liners.
A diagram, the map, and one thing to try this week. That's a page.
awk, one lesson per page
Thirty lessons for the pattern scanning and processing language already on every Unix: patterns and actions, fields and separators, BEGIN and END, associative arrays, printf columns, and the classic report and pivot one-liners.
Set in Space Grotesk, Inter and JetBrains Mono (SIL Open Font License).
Every fact in this book is as the official source states it, fetched and read during this build: The GNU Awk User's Guide at gnu.org/software/gawk/manual (Edition 5.4), cross-checked against the local system gawk(1) manual (GNU Awk 5.2.1) and, for the version-gated page, the local mawk(1) manual; behaviour noted as differing across awk implementations is flagged on the page. Demand evidence from live command-line threads, reconfirmed at dispatch; no facts are sourced from tutorials, howtogeek, linuxize, Reddit or StackExchange. An independent guide, not affiliated with or endorsed by the Free Software Foundation or the GNU project.
Your purchase is for personal use only. You do not have redistribution rights: please do not share, resell, or republish this book or its pages.
© 2026 Steve Hodgkiss. All rights reserved. Personal use only; no redistribution rights.
Edition 1.0 · stevehodgkiss.net
Contents
Per The GNU Awk User's Guide: 'Each rule specifies one pattern to search for and one action to perform upon finding the pattern. Syntactically, a rule consists of a pattern followed by an action. The action is enclosed in braces to separate it from the pattern.'
Pattern, then action
Every awk program is rules, and every rule is two halves. Per the guide, a rule is a pattern followed by an action, the action wrapped in braces. The pattern chooses the lines; the action does the work.
The guide introduces awk as a program to select particular records in a file and perform operations upon them. Select, then operate: that is the whole shape.
Read any awk one-liner as a question and its answer. The question is the pattern; the answer is the action.
Write one rule this week, /error/ { print $1 }, and read it aloud as question then answer before you run it.
Per The GNU Awk User's Guide: 'Here the first field, or $1, is This, the second field, or $2, is seems, and so on'; each line is one record, and awk splits every record into fields as it reads.
Fields by number
awk reads a line and cuts it up before your program sees it. Per the guide, the first field is $1, the second $2, and so on: no split call, no index arithmetic.
Whitespace separates fields by default, so any column-shaped text is already a database: logs, ls output, csv once you set the separator.
The dollars are the reason awk won the column jobs. Field two of every line is $2, always.
Print field one of the password file this week: awk -F : '{ print $1 }' /etc/passwd.
Patterns
The /regular expression/ pattern, any expression as a pattern such as $3 greater than 0, the begpat, endpat range, and BEGIN for work before any input.
- 01/slash/ matches
- 02Before the input
Per The GNU Awk User's Guide, kinds of patterns: '/regular expression/: A regular expression. It matches when the text of the input record fits the regular expression.'
/slash/ matches
The most familiar pattern wears slashes. Per the guide, /regular expression/ matches when the text of the input record fits the regular expression.
It tests the whole record, like grep, but it is one half of a rule: pair it with an action and it selects which lines the action works on.
Slashes select, braces act. Every other pattern is this one asking a different question.
Write /error/ { print NR, $0 } this week and notice the regex and the action working as one rule.
Per The GNU Awk User's Guide: 'BEGIN and END rules are each executed exactly once, at the beginning and end of your awk program, respectively.'
Before the input
Some work belongs before any data: headers, OFS, seeded variables. Per the guide, BEGIN rules are each executed exactly once, at the beginning of the program.
A BEGIN-only program runs with no input files at all, which makes awk 'BEGIN { ... }' a scrappy calculator and a printf test bench.
BEGIN is where the report sets its table: titles printed, separators chosen, counters named.
Print a header before your data this week: BEGIN { print "user uid" } then the matching rows.
Per The GNU Awk User's Guide: awk's arrays are associative, and 'one advantage of associative arrays is that new pairs can be added at any time'; the guide's word-usage program builds counts under keys as they appear.
Count with arrays
Every awk array is an associative array: keys, not positions. Per the guide, new pairs can be added at any time, born when first written.
So counting is one expression: count[$1]++. First sighting creates the entry and increments it; later sightings just increment. No declaration, no sizing.
uniq -c without the sort. This one idiom is half of why arrays exist in awk.
Count by first field this week: awk '{ c[$1]++ } END { for (k in c) print c[k], k }' on unsorted data.
This book's plan: one rule a week, kept: find a column-shaped chore, write one pattern and one action for it, run it on the real data, and keep the one-liners that survive in a notes file.
One habit to keep
The skill compounds like the counters do. One real chore a week: pick the file, write one rule, run it against the actual data until it earns its place.
Keep the survivors in a file of one-liners. The dedupe, the header skip, the column sum, the version gate: four rules already carry most reporting work.
You now read the pattern-action shape the way you read a sentence. Keep a weekly rule and the fluency stays.
Ship one rule this week into your notes file, with the command that ran it and the date, and start the collection.