How to Use the cut Command to Extract Fields and Columns in Linux

Command-line data filtering often requires stripping out unnecessary clutter from structured logs, CSV exports, or Unix system files. While full-scale text parsing engines like awk provide extensive computational logic, they can be over-engineered when you simply need to pull a specific column or isolate a sequence of characters from a text stream. The cut command is a lightweight core utility pre-installed on virtually all Linux distributions. Designed specifically for vertical column slicing, cut processes files and pipes at lightning speed with minimal syntax overhead.

Understanding How the cut Command Slices Text

The cut utility works by reading input line by line and isolating segments based on three core slicing modes:

• Bytes (-b): Extracts sections based on specific byte counts.
• Characters (-c): Slices text based on character positions (ideal for fixed-width log streams).
• Fields (-f): Divides text into structured columns based on a delimiter string (specified with -d).

By default, if no delimiter is declared, cut assumes the tab character (\t) serves as the field separator.

Extracting Delimited Fields (-d and -f)

The most common operational use of cut is parsing delimited data such as colon-separated system files or comma-separated tables.

To extract all system usernames from the standard /etc/passwd database:

cut -d: -f1 /etc/passwd

In this command, -d: specifies that the colon character acts as the field delimiter, and -f1 instructs cut to isolate column one.

To extract multiple non-consecutive columns (such as the username and home directory):

cut -d: -f1,6 /etc/passwd

To extract a continuous range of columns (for example, fields 1 through 3):

cut -d: -f1-3 /etc/passwd

To extract everything from column 3 through to the end of each line:

cut -d: -f3- /etc/passwd

Slicing Fixed-Width Text by Character Position (-c)

When working with fixed-width logs where fields do not share a common punctuation delimiter, slice by explicit character offsets:

To isolate the file permissions string (the first 10 characters) from an ls -l directory listing:

ls -l | cut -c1-10

To extract specific non-contiguous character offsets (such as characters 1 through 5, and character 20 onwards):

cut -c1-5,20- logfile.txt

Essential cut Command Options Reference

Option	Syntax Example	Functionality
-d	cut -d',' -f1 file.csv	Specifies custom field delimiter character
-f	cut -d: -f2,4 /etc/passwd	Selects target field or range of fields to display
-c	cut -c1-8 file.txt	Selects characters by position indices
-b	cut -b1-16 file.bin	Selects raw bytes by position indices
--complement	cut -d: --complement -f2 file	Inverts selection: displays all fields EXCEPT those specified
-s	cut -d, -s -f1 data.txt	Suppresses (skips) lines that do not contain delimiter
--output-delimiter	cut -d: -f1,7 --output-delimiter=' ' file	Replaces original delimiter with custom output separator

Advanced Pipeline Techniques: Combining cut with Sort and Uniq

The true power of cut emerges when chained with standard Unix pipeline utilities to perform quick terminal analytics:

To find the top unique web visitors from an Nginx or Apache access log where the client IP address occupies the first whitespace column:

cut -d' ' -f1 /var/log/nginx/access.log | sort | uniq -c | sort -nr | head -n 10

In this workflow, cut isolates the IP column, sort orders the entries, uniq -c tallies occurrences, sort -nr ranks counts in descending order, and head -n 10 delivers the top ten visitors.

Frequently Asked Questions

How can I make cut handle consecutive whitespace or multiple spaces?

By default, cut interprets each single space as an individual delimiter. If input text contains irregular spaces (like ps or df output), squeeze consecutive spaces with tr -s ' ' before piping into cut: df -h | tr -s ' ' | cut -d' ' -f1,5.

Can cut use multi-character delimiters?

No. The cut utility strictly accepts single-character delimiters. If your data relies on multi-character delimiters (such as :: or --), use awk -F"::" instead.

What does the –complement flag do?

The --complement flag reverses your column selection. For example, cut -d: --complement -f2 displays every column across the row except column 2.