Command line CLI · 06 · 01

cut and fields

cut slices columns from delimited text. -d sets the delimiter, -f selects fields by number or range, -c cuts by character position. Together they replace a full parser for simple structured logs and TSV files.

CLI Middle ◷ 20 min

Level

FoundationsJuniorMiddleSenior

Every system produces structured text — access logs, /etc/passwd, CSV exports, TSV dumps from databases. The columns you need are buried inside lines you mostly don’t care about. cut is the fastest way to extract a single column from a stream: one flag for the delimiter, one for the field number, and you’re done. It doesn’t parse quotes, handle escaped delimiters, or understand headers — and for most machine-generated output that’s fine. When you need column 3 of a colon-separated file, cut -d: -f3 is ten characters and zero dependencies.

By the end of this lesson you will be able to slice any single-delimiter text by field number, by field range, and by character position.

Goal

After this lesson you can use cut -d DELIM -f N to extract field N from delimiter-separated input, use -f N-M and -f N,M for ranges and lists, use -c for character-position cuts, and chain cut in a pipeline to clean up structured log output.

cut -d DELIM -f N extracts field N, counting from 1. The -d flag sets the input delimiter (a single character); -f names the field number. If the delimiter is a colon, field 1 is everything before the first colon, field 2 is between the first and second colon, and so on.

echo "root:x:0:0:root:/root:/bin/bash" | cut -d: -f1

Output: root

echo "root:x:0:0:root:/root:/bin/bash" | cut -d: -f7

Output: /bin/bash

The default delimiter is a tab character. Without -d, cut expects tab-separated input (TSV).

-f N-M selects a contiguous range; -f N,M selects a list. You can combine both forms.

cut -d: -f1,7 /etc/passwd

Prints username (field 1) and shell (field 7) for every line — two fields, comma-separated in the -f argument, no separator between them in the output (the original delimiter is used).

cut -d: -f1-3 /etc/passwd

Fields 1 through 3: username, password placeholder, UID.

Open-ended ranges: -f3- means “field 3 to the end of the line”. -f-3 means “field 1 through 3”. These are useful when you don’t know exactly how many fields a line has.

cut -d, -f2- data.csv

Drops the first CSV column and keeps everything else.

-c cuts by character position, not by delimiter. This is the right tool for fixed-width formats — log timestamps, columnar reports where fields are always the same number of characters wide.

date
# Thu Jun 19 14:32:07 UTC 2025
date | cut -c1-3
# Thu

-c1-3 keeps characters 1, 2, and 3 — just the day abbreviation. The same range syntax applies: -c5-7 for positions 5–7, -c1,5 for positions 1 and 5.

For fixed-width syslog lines the timestamp is always the same width, so -c cuts it precisely without any delimiter logic at all.

cut in a pipeline: chain with sort, uniq, and grep. cut reads from stdin when no file is given, so it slots naturally into any pipeline stage.

cat /etc/passwd | cut -d: -f1 | sort

All usernames, sorted alphabetically.

getent passwd | cut -d: -f7 | sort -u

Every unique shell configured on the system. -u in sort deduplicates (equivalent to sort | uniq).

ss -tlnp | grep LISTEN | cut -d: -f2 | cut -d' ' -f1

Port numbers of all TCP listeners. The first cut splits on : to get the address:port part; the second cut splits on space to isolate just the port number. Two-stage cuts are common for tricky formats.

Footgun: cut does not understand quoting or escaping. If a CSV field contains a comma inside double quotes — "Smith, John" — cut -d, -f2 will split on the comma inside the quotes and give you the wrong answer. For proper CSV parsing, use awk, python -c, or a dedicated tool like csvkit. cut is reliable for machine-generated output where the delimiter never appears inside field values.

echo '"Smith, John",alice,30' | cut -d, -f1
# "Smith

The output is wrong — it split inside the quoted field. Know your data before reaching for cut.

cut reads a delimited line, splits it by the delimiter, and emits only the requested fields. Upstream producers (cat, getent, ss) provide the stream; downstream consumers (sort, uniq) process the extracted columns.

Worked example

Extract unique shells from /etc/passwd and count how many users use each.

cut -d: -f7 /etc/passwd | sort | uniq -c | sort -rn

Step by step:

cut -d: -f7 /etc/passwd — extract field 7 (the shell) from every line.
sort — group identical shells together (required before uniq).
uniq -c — count consecutive identical lines, printing count shell.
sort -rn — sort numerically in reverse so the most common shell is first.

Example output on a typical server:

     42 /usr/sbin/nologin
      8 /bin/bash
      3 /bin/sh
      1 /bin/sync

This pipeline answers “what shells are in use and how many users have each?” in a single composable command — no scripting required.

▸Why this works

On macOS and other BSDs, cut behavior is identical to GNU cut for the flags covered here (-d, -f, -c). The difference: BSD cut does not support --output-delimiter (a GNU extension that changes the output separator when printing multiple fields). If you need a different output delimiter, use awk -F: '{print $1 "\t" $7}' instead — that works on both platforms.

▸Common mistake

A common mistake is forgetting that cut -f counts from 1, not 0. Field 1 is the first column. Running cut -f0 gives an error on GNU cut and silently produces no output on some BSD versions. Another trap: cut outputs fields in the order they appear in the input line, not the order you list them in -f. cut -d: -f7,1 outputs field 1 then field 7 — the same as -f1,7. To reorder fields, use awk '{print $7, $1}'.

Check yourself

Quiz

You run: echo 'a:b:c:d:e' | cut -d: -f2-4. What is the output?

Recap

cut extracts columns from delimiter-separated text. -d DELIM sets the field separator (default is tab); -f N selects a field, -f N-M a range, -f N,M a list. -c cuts by character position for fixed-width formats. cut does not handle quoted delimiters — use it for machine-generated output where the delimiter never appears inside values. In a pipeline, cut slots between the producer and downstream tools like sort and uniq to extract the column you actually want before counting or deduplicating.

Practice

Start at the top. Tasks go easiest → hardest: recall a fact, apply it to a case, then a senior-level stretch. Open one, attempt it, then reveal.

recallapplystretch0 of 4 done

Something unclear?

Ask a question about this lesson. Questions are anonymous and go straight to the author to make the lesson better.