Counting and slicing

wc counts lines, words, and bytes. The name stands for “word count” but it counts more than words.

wc /etc/passwd

Output:

 45  90 2751 /etc/passwd

Three numbers: line count, word count, byte count. Flags let you select one:

wc -l /etc/passwd     # line count only
wc -w /etc/passwd     # word count only
wc -c /etc/passwd     # byte count only

wc -l is by far the most common: “how many lines does this produce?”

ls /etc | wc -l

Count the number of entries in /etc.

head and tail slice the top or bottom N lines. By default both show 10 lines. Use -n N to change the count.

head -n 5 /etc/passwd     # first 5 lines
tail -n 5 /etc/passwd     # last 5 lines

tail -f follows a file as it grows — invaluable for watching logs in real time:

tail -f /var/log/syslog

New lines appear as they are appended. Press Ctrl+C to stop.

Both tools work with pipes:

ls /etc | head -n 10    # first 10 entries
ls /etc | tail -n 10    # last 10 entries

sort orders lines alphabetically by default. It reads all input, sorts it, then writes it out. Key flags:

• -r — reverse order (Z→A, or largest→smallest with -n)
• -n — numeric sort (so “10” sorts after “9”, not before “2”)
• -k N — sort by field N (splitting on whitespace)
• -u — unique: output each value only once (like sort | uniq)

ls /etc | sort           # alphabetical
ls /etc | sort -r        # reverse alphabetical
cat numbers.txt | sort -n   # numeric order

sort -n is critical when you want to rank by count: without it, “10” would sort before “2” because “1” < “2” lexicographically.

uniq -c collapses consecutive identical lines into one, prefixed with the count. The key word is consecutive — uniq only detects adjacent duplicates. That is why sort must come first: sort brings all identical lines together so uniq can count them.

printf 'apple\nbanana\napple\ncherry\nbanana\napple\n' | sort | uniq -c

After sort the stream is: apple apple apple banana banana cherry.

uniq -c output:

      3 apple
      2 banana
      1 cherry

The number is left-padded with spaces by default. The format is <count> <value>.

The classic frequency pipeline: sort | uniq -c | sort -rn | head. This four-stage pattern finds the most common items in any stream:

1. sort — group identical items together.
2. uniq -c — count each group.
3. sort -rn — sort numerically in reverse (highest count first).
4. head -n 10 — take the top 10.

awk '{print $1}' /var/log/nginx/access.log | sort | uniq -c | sort -rn | head -n 10

This extracts the IP field (field 1 in nginx logs), counts each IP’s appearances, and shows the top 10 — the clients making the most requests. The same four-stage pattern works on any text: HTTP status codes, user agents, error messages, git commit authors, etc.