sort and uniq

sort orders lines lexically by default. Lexical order compares character by character using ASCII/Unicode values. This means 10 sorts before 9 because '1' < '9' as characters — a classic footgun.

printf '10\n9\n100\n2\n' | sort
# 10
# 100
# 2
# 9

The lines are in ASCII order (digits compared left-to-right as characters). This is correct for alphabetical sorting of strings, wrong for numeric values.

-n switches to numeric sort. Numbers are parsed as values, not character sequences.

printf '10\n9\n100\n2\n' | sort -n
# 2
# 9
# 10
# 100

Always use -n when your data is a column of numbers. Forgetting -n is one of the most common sort bugs in shell scripts.

-r reverses the sort order. Combined with -n, it gives largest-first ordering.

printf '10\n9\n100\n2\n' | sort -rn
# 100
# 10
# 9
# 2

-u deduplicates: sort -u is equivalent to sort | uniq but faster because deduplication happens during the sort pass.

printf 'b\na\nb\nc\na\n' | sort -u
# a
# b
# c

Use sort -u when you just want unique values; use sort | uniq -c when you want unique values with counts.

-k N sorts on field N. By default sort treats whitespace as the field delimiter. -k2 sorts on the second whitespace-separated field; -k2,2 sorts only on field 2 (without -k2,2 the sort continues on subsequent fields as a tiebreaker).

cat sizes.txt
# 150M  /var/log
# 2G    /usr
# 800M  /home
sort -k1 sizes.txt          # lexical on size: 150M, 2G, 800M (wrong order)
sort -k2 sizes.txt          # lexical on path: /home, /usr, /var/log

For numeric sort on a field, combine -k with -n:

# Sort access log by response size (field 10 in Combined Log Format)
sort -k10 -n access.log | tail -5

The five largest responses appear last — the bottom of a numerically sorted list. Add -r to put the largest first.

For a custom delimiter, add -t:

sort -t: -k3 -n /etc/passwd

Sort /etc/passwd by UID (field 3), numerically, with : as the delimiter.

uniq -c counts consecutive identical lines. It must receive sorted input — uniq only compares each line to the one immediately before it. If identical lines are not adjacent, each group gets its own count.

printf 'error\nwarn\nerror\n' | uniq -c
# 1 error
# 1 warn
# 1 error          ← counted separately because not adjacent

After sort:

printf 'error\nwarn\nerror\n' | sort | uniq -c
# 2 error
# 1 warn

Now both error lines are adjacent, so they collapse into one count of 2.

The sort | uniq -c | sort -rn top-N idiom. The three stages work together:

1. sort — bring identical lines adjacent.
2. uniq -c — count each group, producing lines like 4 error.
3. sort -rn — sort numerically in reverse so the highest-count item is first.

Append | head -10 to get the top 10.

# Top 10 IPs in an nginx access log (IP is field 1)
awk '{print $1}' access.log | sort | uniq -c | sort -rn | head -10

# Top HTTP status codes
awk '{print $9}' access.log | sort | uniq -c | sort -rn

The uniq -c output format has a count, then a space, then the value. The second sort -rn sorts on the count because it is the first field. This idiom is transferable to any domain: error types, user agents, SQL query hashes, event names.