cut Command Cheat Sheet

cut removes sections from each line of files. It is designed to extract specific columns or fields from text data, especially structured data like CSVs or system logs.

Synopsis

cut OPTION... [FILE]...

Basic Usage

Extract Characters (-c)

Select specific character positions.

# Extract characters 1 through 5
cut -c 1-5 file.txt

# Extract 1st, 3rd, and 5th characters
cut -c 1,3,5 file.txt

# Extract from 10th character to end of line
cut -c 10- file.txt

Extract Bytes (-b)

Select specific byte positions (useful for fixed-width binary data). For single-byte encodings (like ASCII), -b and -c are identical.

cut -b 1-10 file.bin

Field Extraction (-f)

The most common use of cut is to split lines by a delimiter.

Specify Delimiter (-d)

The default delimiter is TAB. Use -d to change it.

# Extract the 1st field from /etc/passwd (user names)
cut -d ':' -f 1 /etc/passwd

Select Multiple Fields

# Extract 1st and 3rd fields
cut -d ',' -f 1,3 data.csv

# Extract fields 1 through 3
cut -d ',' -f 1-3 data.csv

Advanced Options

Complement Selection (--complement)

Select everything except the specified fields.

# Print all fields EXCEPT the 2nd one
cut -d ',' --complement -f 2 data.csv

Change Output Delimiter (--output-delimiter)

Change the separator in the output.

# Input: 1:2:3 -> Output: 1 | 2 | 3
echo "1:2:3" | cut -d ':' -f 1-3 --output-delimiter=' | '

Only Delimited Lines (-s)

Do not print lines that do not contain the delimiter.

# Only print lines that actually have a colon
cut -s -d ':' -f 1 file.txt

Ranges

Practical Examples

Extract IP Addresses from Logs

Assuming standard Apache/Nginx log format (space-separated, IP is 1st field).

cut -d ' ' -f 1 access.log

Get Current WiFi SSID

iwgetid -r
# OR using cut on iwconfig output
iwconfig 2>/dev/null | grep 'ESSID' | cut -d '"' -f 2

Parse /etc/shadow

Check password expiration fields (fields 3-8).

sudo cut -d ':' -f 1,3-8 /etc/shadow

Extract File Permissions

From ls -l output (permissions are column 1, file name is usually col 9, but spaces vary). awk is better here, but cut can work with fixed width if formatted.

ls -l | cut -c 2-10

cut vs awk

When to use cut: - Simple, predictable delimiters (CSV, /etc/passwd). - Fixed-width data. - Performance is critical (faster than awk).

When to use awk: - Variable whitespace (e.g., ls -l or ps aux output). - Complex logic or math is needed.

Limitations

• Single character delimiter: cut only accepts a single character for -d. You cannot split by " - " or spaces.
• Strict whitespace: cut -d ' ' treats every space as a field separator. foo bar (3 spaces) has empty fields in between. Use tr -s ' ' to squeeze spaces first.

# Squeeze spaces before cutting
ps aux | tr -s ' ' | cut -d ' ' -f 2

Exit Status