Field Extraction

Print first field (default whitespace delimiter)

cat <<'EOF' > /tmp/demo.txt
10.50.1.20  ise-01   active
10.50.1.50  ad-dc    active
10.50.1.1   pfsense  standby
EOF
awk '{print $1}' /tmp/demo.txt

Print fields 1 and 3

cat <<'EOF' > /tmp/demo.txt
10.50.1.20  ise-01   active
10.50.1.50  ad-dc    active
10.50.1.1   pfsense  standby
EOF
awk '{print $1, $3}' /tmp/demo.txt

Print last field on each line

cat <<'EOF' > /tmp/demo.txt
2026-04-11 08:14:22 sshd accepted publickey for evan from 10.50.1.100
2026-04-11 08:14:23 sshd accepted password for root from 10.50.1.50
EOF
awk '{print $NF}' /tmp/demo.txt

Print second-to-last field

cat <<'EOF' > /tmp/demo.txt
2026-04-11 08:14:22 sshd accepted publickey for evan from 10.50.1.100
2026-04-11 08:14:23 sshd accepted password for root from 10.50.1.50
EOF
awk '{print $(NF-1)}' /tmp/demo.txt

Colon-delimited — extract user, UID, home from /etc/passwd

awk -F: '{print $1, $3, $6}' /etc/passwd

CSV field extraction

cat <<'EOF' > /tmp/demo.csv
ise-01,10.50.1.20,active,pan
ad-dc,10.50.1.50,active,dc
pfsense,10.50.1.1,active,firewall
EOF
awk -F, '{print $2}' /tmp/demo.csv

Tab-delimited input

printf 'ise-01\t10.50.1.20\tactive\nad-dc\t10.50.1.50\tactive\n' > /tmp/demo.tsv
awk -F'\t' '{print $1, $3}' /tmp/demo.tsv

Multiple delimiters — split on comma, colon, or semicolon

cat <<'EOF' > /tmp/demo.txt
ise-01,10.50.1.20;pan:active
ad-dc,10.50.1.50;dc:active
EOF
awk -F'[,;:]' '{print $1, $2}' /tmp/demo.txt

Set output field separator — colon input to CSV output

awk -F: -v OFS=',' '{print $1, $3, $6}' /etc/passwd

Print all fields except the first

cat <<'EOF' > /tmp/demo.txt
WARN firewall dropped packet from 10.50.1.200 to 10.50.1.1 port 443
INFO sshd accepted publickey for evan from 10.50.1.100 port 22
EOF
awk '{$1=""; print substr($0,2)}' /tmp/demo.txt

Extract IPs from ip addr output (skip loopback)

ip -4 -o addr show | awk '{split($4,a,"/"); if($2!="lo") print $2, a[1]}'

Formatted column output from ps

ps aux | awk '{printf "%-10s %5s %5s %s\n", $1, $2, $3, $11}'