Sed awk perl grep cheat sheet. GitHub Gist: instantly share code, notes, and snippets. Grep Cheat Sheet Escaped Values Autopsy uses the grep utility to search an image. Grep requires that some values be 'escaped' if they are searched for. Autopsy will automatically escape those values if the serach is being done for a non-regular expression.The escaped values include.

Introduction

Discover the power of grep and regular expressions with this easy to follow beginners tutorial with plenty of examples to guide you.

In the previous section we looked at a collection of filters that would manipulate data for us. In this section we will look at another filter which is quite powerful when combined with a concept called regular expressions or re's for short. Re's can be a little hard to get your head around at first so don't worry if this stuff is a little confusing. I find the best approach is to go over the material and experiment on the command line a little, then leave it for a day or 3, then come back and have another go. You will be surprised but it will start to make more sense the second time. Mastering re's just takes practice and time so don't give up.

So what are they?

Regular expressions are similar to the wildcards that we looked at in section 7. They allow us to create a pattern. They are a bit more powerful however. Re's are typically used to identify and manipulate specific pieces of data. eg. we may wish to identify every line which contains an email address or a url in a set of data.

Re's are used all over the place. We will be demonstrating them here with grep but many other programs use them (including sed and vi which you learned about in previous sections) and many programming languages make use of them too.

I'll give you an introduction to them here in this section but there is much more they can do. If you are interested then I highly recommend going through our regular expression tutorial which goes into more detail.

The characters used in regular expressions are the same as those used in wildcards. Their behaviour is slightly different however. A common mistake is to forget this and get their functions mixed up.

eGrep

egrep is a program which will search a given set of data and print every line which contains a given pattern. It is an extension of a program called grep. It's name is odd but based upon a command which did a similar function, in a text editor called ed. It has many command line options which modify it's behaviour so it's worth checking out it's man page. ie the -v option tells grep to instead print every line which does not match the pattern.

egrep [command line options] <pattern> [path]

In the examples below we will use a similar sample file as in the last section. It is included below as a reference.

1. cat mysampledata.txt
2. Fred apples 20
3. Susy oranges 5
4. Mark watermellons 12
5. Robert pears 4
6. Terry oranges 9
7. Lisa peaches 7
8. Susy oranges 12
9. Mark grapes 39
10. Anne mangoes 7
11. Greg pineapples 3
12. Oliver rockmellons 2
13. Betty limes 14

Let's say we wished to identify every line which contained the string mellon

1. egrep 'mellon' mysampledata.txt
2. Mark watermellons 12
3. Oliver rockmellons 2

The basic behaviour of egrep is that it will print the entire line for every line which contains a string of characters matching the given pattern. This is important to note, we are not searching for a word but a string of characters.

Also note that we included the pattern within quotes. This is not always required but it is safer to get in the habit of always using them. They are required if your pattern contains characters which have a special meaning on the command line.

Sometimes we want to know not only which lines matched but their line number as well.

1. egrep -n 'mellon' mysampledata.txt
2. 3:Mark watermellons 12
3. 11:Oliver rockmellons 2

Or maybe we are not interested in seeing the matched lines but wish to know how many lines did match.

Learning Regular Expressions

The best way to learn regular expressions is to give the examples a try yourself, then modify them slightly to test your understanding. It is common to make mistakes in your patterns while you are learning. When this happens typically every line will be matched or no lines will be matched or some obscure set. Don't worry if this happens you haven't done any damage and you can easily go back and have another go. Remember you may hit the up arrow on your keyboard to get at your recent commands and also modify them so you don't need to retype the whole command each time.

If you're not getting the output you would like then here are some basic strategies.

• First off, check for typo's. If you're like me then you're prone to making them.
• Re read the content here. Maybe what you thought a particular operator did was slightly different to what it actually does and re reading you will notice a point you may have missed the first time.
• Break your pattern down into individual components and test each of these individually. This will help you to get a feel for which parts of the pattern is right and which parts you need to adjust.
• Examine your output. Your current pattern may not have worked the way you want but we can still learn from it. Looking at what we actually did match and using it to help understand what actually did happen will help us to work out what we should try changing to get closer to what we actually want.

Debuggex is an on-line tool that allows you to experiment with regular expressions and allows you to visualise their behaviour. It can be a good way to better understand how they work.

Linux Grep Command Cheat Sheet

Regular Expression Overview

I will outline the basic building blocks of re's below then follow on with a set of examples to demonstrate their usage.

• . (dot) - a single character.
• ? - the preceding character matches 0 or 1 times only.
• * - the preceding character matches 0 or more times.
• + - the preceding character matches 1 or more times.
• {n} - the preceding character matches exactly n times.
• {n,m} - the preceding character matches at least n times and not more than m times.
• [agd] - the character is one of those included within the square brackets.
• [^agd] - the character is not one of those included within the square brackets.
• [c-f] - the dash within the square brackets operates as a range. In this case it means either the letters c, d, e or f.
• () - allows us to group several characters to behave as one.
• | (pipe symbol) - the logical OR operation.
• ^ - matches the beginning of the line.
• $ - matches the end of the line.

Some Examples

We'll start with something simple. Let's say we wish to identify any line with two or more vowels in a row. In the example below the multiplier {2,} applies to the preceding item which is the range.

1. egrep '[aeiou]{2,}' mysampledata.txt
2. Robert pears 4
3. Lisa peaches 7
4. Anne mangoes 7
5. Greg pineapples 3

How about any line with a 2 on it which is not the end of the line. In this example the multiplier + applies to the . which is any character.

The number 2 as the last character on the line.

1. egrep '2$' mysampledata.txt
2. Mark watermellons 12
3. Susy oranges 12
4. Oliver rockmellons 2

And now each line which contains either 'is' or 'go' or 'or'.

1. egrep 'or|is|go' mysampledata.txt
2. Susy oranges 5
3. Terry oranges 9
4. Lisa peaches 7
5. Susy oranges 12
6. Anne mangoes 7

Maybe we wish to see orders for everyone who's name begins with A - K.

1. egrep '^[A-K]' mysampledata.txt
2. Fred apples 20
3. Anne mangoes 7
4. Greg pineapples 3
5. Betty limes 14

Summary

Activities

Let's identify some information.

• First off, you may want to make a file with data similar to our sample file.
• Now play with some of the examples we looked at above.
• Have a look at the man page for egrep and try atleast 2 of the command line options for them.

The tables below are a reference to basic regex. While reading the rest of the site, when in doubt, you can always come back and look here. (It you want a bookmark, here's a direct link to the regex reference tables). I encourage you to print the tables so you have a cheat sheet on your desk for quick reference.
The tables are not exhaustive, for two reasons. First, every regex flavor is different, and I didn't want to crowd the page with overly exotic syntax. For a full reference to the particular regex flavors you'll be using, it's always best to go straight to the source. In fact, for some regex engines (such as Perl, PCRE, Java and .NET) you may want to check once a year, as their creators often introduce new features.
The other reason the tables are not exhaustive is that I wanted them to serve as a quick introduction to regex. If you are a complete beginner, you should get a firm grasp of basic regex syntax just by reading the examples in the tables. I tried to introduce features in a logical order and to keep out oddities that I've never seen in actual use, such as the 'bell character'. With these tables as a jumping board, you will be able to advance to mastery by exploring the other pages on the site.

How to use the tables

The tables are meant to serve as an accelerated regex course, and they are meant to be read slowly, one line at a time. On each line, in the leftmost column, you will find a new element of regex syntax. The next column, 'Legend', explains what the element means (or encodes) in the regex syntax. The next two columns work hand in hand: the 'Example' column gives a valid regular expression that uses the element, and the 'Sample Match' column presents a text string that could be matched by the regular expression.
You can read the tables online, of course, but if you suffer from even the mildest case of online-ADD (attention deficit disorder), like most of us… Well then, I highly recommend you print them out. You'll be able to study them slowly, and to use them as a cheat sheet later, when you are reading the rest of the site or experimenting with your own regular expressions.
Enjoy!
If you overdose, make sure not to miss the next page, which comes back down to Earth and talks about some really cool stuff: The 1001 ways to use Regex.

Regex Accelerated Course and Cheat Sheet

For easy navigation, here are some jumping points to various sections of the page:
✽ Characters
✽ Quantifiers
✽ More Characters
✽ Logic
✽ More White-Space
✽ More Quantifiers
✽ Character Classes
✽ Anchors and Boundaries
✽ POSIX Classes
✽ Inline Modifiers
✽ Lookarounds
✽ Character Class Operations
✽ Other Syntax

Indesign Grep Commands

(direct link)

Characters

Character	Legend	Example	Sample Match
d	Most engines: one digit from 0 to 9	file_dd	file_25
d	.NET, Python 3: one Unicode digit in any script	file_dd	file_9੩
w	Most engines: 'word character': ASCII letter, digit or underscore	w-www	A-b_1
w	.Python 3: 'word character': Unicode letter, ideogram, digit, or underscore	w-www	字-ま_۳
w	.NET: 'word character': Unicode letter, ideogram, digit, or connector	w-www	字-ま‿۳
s	Most engines: 'whitespace character': space, tab, newline, carriage return, vertical tab	asbsc	a b c
s	.NET, Python 3, JavaScript: 'whitespace character': any Unicode separator	asbsc	a b c
D	One character that is not a digit as defined by your engine's d	DDD	ABC
W	One character that is not a word character as defined by your engine's w	WWWWW	*-+=)
S	One character that is not a whitespace character as defined by your engine's s	SSSS	Yoyo

(direct link)

Quantifiers

Quantifier	Legend	Example	Sample Match
+	One or more	Version w-w+	Version A-b1_1
{3}	Exactly three times	D{3}	ABC
{2,4}	Two to four times	d{2,4}	156
{3,}	Three or more times	w{3,}	regex_tutorial
*	Zero or more times	A*B*C*	AAACC
?	Once or none	plurals?	plural

(direct link)

More Characters

Character	Legend	Example	Sample Match
.	Any character except line break	a.c	abc
.	Any character except line break	.*	whatever, man.
.	A period (special character: needs to be escaped by a )	a.c	a.c
	Escapes a special character	.*+? $^/	.*+? $^/
	Escapes a special character	[{()}]	[{()}]

(direct link)

Logic

Logic	Legend	Example	Sample Match
|	Alternation / OR operand	22|33	33
( … )	Capturing group	A(nt|pple)	Apple (captures 'pple')
1	Contents of Group 1	r(w)g1x	regex
2	Contents of Group 2	(dd)+(dd)=2+1	12+65=65+12
(?: … )	Non-capturing group	A(?:nt|pple)	Apple

(direct link)

More White-Space

Character	Legend	Example	Sample Match
t	Tab	Ttw{2}	T ab
r	Carriage return character	see below
n	Line feed character	see below
rn	Line separator on Windows	ABrnCD	AB CD
N	Perl, PCRE (C, PHP, R…): one character that is not a line break	N+	ABC
h	Perl, PCRE (C, PHP, R…), Java: one horizontal whitespace character: tab or Unicode space separator
H	One character that is not a horizontal whitespace
v	.NET, JavaScript, Python, Ruby: vertical tab
v	Perl, PCRE (C, PHP, R…), Java: one vertical whitespace character: line feed, carriage return, vertical tab, form feed, paragraph or line separator
V	Perl, PCRE (C, PHP, R…), Java: any character that is not a vertical whitespace
R	Perl, PCRE (C, PHP, R…), Java: one line break (carriage return + line feed pair, and all the characters matched by v)

(direct link)

More Quantifiers

Quantifier	Legend	Example	Sample Match
+	The + (one or more) is 'greedy'	d+	12345
?	Makes quantifiers 'lazy'	d+?	1 in 12345
*	The * (zero or more) is 'greedy'	A*	AAA
?	Makes quantifiers 'lazy'	A*?	empty in AAA
{2,4}	Two to four times, 'greedy'	w{2,4}	abcd
?	Makes quantifiers 'lazy'	w{2,4}?	ab in abcd

(direct link)

Character Classes

Character	Legend	Example	Sample Match
[ … ]	One of the characters in the brackets	[AEIOU]	One uppercase vowel
[ … ]	One of the characters in the brackets	T[ao]p	Tap or Top
-	Range indicator	[a-z]	One lowercase letter
[x-y]	One of the characters in the range from x to y	[A-Z]+	GREAT
[ … ]	One of the characters in the brackets	[AB1-5w-z]	One of either: A,B,1,2,3,4,5,w,x,y,z
[x-y]	One of the characters in the range from x to y	[ -~]+	Characters in the printable section of the ASCII table.
[^x]	One character that is not x	[^a-z]{3}	A1!
[^x-y]	One of the characters not in the range from x to y	[^ -~]+	Characters that are not in the printable section of the ASCII table.
[dD]	One character that is a digit or a non-digit	[dD]+	Any characters, inc- luding new lines, which the regular dot doesn't match
[x41]	Matches the character at hexadecimal position 41 in the ASCII table, i.e. A	[x41-x45]{3}	ABE

(direct link)

Anchors and Boundaries

Anchor	Legend	Example	Sample Match
^	Start of string or start of line depending on multiline mode. (But when [^inside brackets], it means 'not')	^abc .*	abc (line start)
$	End of string or end of line depending on multiline mode. Many engine-dependent subtleties.	.*? the end$	this is the end
A	Beginning of string (all major engines except JS)	Aabc[dD]*	abc (string... ...start)
z	Very end of the string Not available in Python and JS	the endz	this is...n...the end
Z	End of string or (except Python) before final line break Not available in JS	the endZ	this is...n...the endn
G	Beginning of String or End of Previous Match .NET, Java, PCRE (C, PHP, R…), Perl, Ruby
b	Word boundary Most engines: position where one side only is an ASCII letter, digit or underscore	Bob.*bcatb	Bob ate the cat
b	Word boundary .NET, Java, Python 3, Ruby: position where one side only is a Unicode letter, digit or underscore	Bob.*bкошкаb	Bob ate the кошка
B	Not a word boundary	c.*BcatB.*	copycats

(direct link)

Grep Cheat Sheet Pdf

POSIX Classes

Character	Legend	Example	Sample Match
[:alpha:]	PCRE (C, PHP, R…): ASCII letters A-Z and a-z	[8[:alpha:]]+	WellDone88
[:alpha:]	Ruby 2: Unicode letter or ideogram	[[:alpha:]d]+	кошка99
[:alnum:]	PCRE (C, PHP, R…): ASCII digits and letters A-Z and a-z	[[:alnum:]]{10}	ABCDE12345
[:alnum:]	Ruby 2: Unicode digit, letter or ideogram	[[:alnum:]]{10}	кошка90210
[:punct:]	PCRE (C, PHP, R…): ASCII punctuation mark	[[:punct:]]+	?!.,:;
[:punct:]	Ruby: Unicode punctuation mark	[[:punct:]]+	‽,:〽⁆

(direct link)

Inline Modifiers

None of these are supported in JavaScript. In Ruby, beware of (?s) and (?m).

Modifier	Legend	Example	Sample Match
(?i)	Case-insensitive mode (except JavaScript)	(?i)Monday	monDAY
(?s)	DOTALL mode (except JS and Ruby). The dot (.) matches new line characters (rn). Also known as 'single-line mode' because the dot treats the entire input as a single line	(?s)From A.*to Z	From A to Z
(?m)	Multiline mode (except Ruby and JS) ^ and $ match at the beginning and end of every line	(?m)1rn^2$rn^3$	1 2 3
(?m)	In Ruby: the same as (?s) in other engines, i.e. DOTALL mode, i.e. dot matches line breaks	(?m)From A.*to Z	From A to Z
(?x)	Free-Spacing Mode mode (except JavaScript). Also known as comment mode or whitespace mode	(?x) # this is a # comment abc # write on multiple # lines [ ]d # spaces must be # in brackets	abc d
(?n)	.NET, PCRE 10.30+: named capture only	Turns all (parentheses) into non-capture groups. To capture, use named groups.
(?d)	Java: Unix linebreaks only	The dot and the ^ and $ anchors are only affected by n
(?^)	PCRE 10.32+: unset modifiers	Unsets ismnx modifiers

(direct link)

Lookarounds

Lookaround	Legend	Example	Sample Match
(?=…)	Positive lookahead	(?=d{10})d{5}	01234 in 0123456789
(?<=…)	Positive lookbehind	(?<=d)cat	cat in 1cat
(?!…)	Negative lookahead	(?!theatre)thew+	theme
(?<!…)	Negative lookbehind	w{3}(?<!mon)ster	Munster

(direct link)

Character Class Operations

Class Operation	Legend	Example	Sample Match
[…-[…]]	.NET: character class subtraction. One character that is in those on the left, but not in the subtracted class.	[a-z-[aeiou]]	Any lowercase consonant
[…-[…]]	.NET: character class subtraction.	[p{IsArabic}-[D]]	An Arabic character that is not a non-digit, i.e., an Arabic digit
[…&&[…]]	Java, Ruby 2+: character class intersection. One character that is both in those on the left and in the && class.	[S&&[D]]	An non-whitespace character that is a non-digit.
[…&&[…]]	Java, Ruby 2+: character class intersection.	[S&&[D]&&[^a-zA-Z]]	An non-whitespace character that a non-digit and not a letter.
[…&&[^…]]	Java, Ruby 2+: character class subtraction is obtained by intersecting a class with a negated class	[a-z&&[^aeiou]]	An English lowercase letter that is not a vowel.
[…&&[^…]]	Java, Ruby 2+: character class subtraction	[p{InArabic}&&[^p{L}p{N}]]	An Arabic character that is not a letter or a number

(direct link)

Other Syntax

Syntax	Legend	Example	Sample Match
K	Keep Out Perl, PCRE (C, PHP, R…), Python's alternate regex engine, Ruby 2+: drop everything that was matched so far from the overall match to be returned	prefixKd+	12
Q…E	Perl, PCRE (C, PHP, R…), Java: treat anything between the delimiters as a literal string. Useful to escape metacharacters.	Q(C++ ?)E	(C++ ?)

The 1001 ways to use Regex

Linux Grep Command Cheat Sheet

Linux Grep Cheat Sheet

Linux Regular Expressions Cheat Sheet