It’s fast, it’s powerful, and its very name suggests that it does something technical: grep. With this workhorse of the command line, you can quickly find text hidden in your files. Understanding grep is the first step in joining the guild of command-line wizards.
Why Not Use the Finder?
It’s easy to find files with the Finder when you know their names. But the grep command is a time-saver when you’re trying to find what’s inside files. You can use grep easily from the command line to search for specific text, and you’ll get results in seconds. (You can also use grep within certain text editors.)
The Finder offers a similar function: the Find By Content search. (Press Command-F in the Finder, select Content in the Search For Items Whose pop-up menu, and enter a search string in the text field.) But the Finder searches only inside files it has indexed, and it ignores hidden system files unless you expressly choose to search for visible and invisible files and add your System folder to the search.
The Finder also lacks grep’s flexibility: while it’s good for searching for a specific word (for example, Walden ), it becomes less useful when you want to find a longer string. Search for Walden Pond, and it returns all files that contain either Walden or Pond.
Using grep also gives you access to regular expressions. These combinations of letters, numbers, wild cards, and other special characters let you find much more than mere words. You can search for just about any string of characters: IP addresses in log files; phone numbers in contact lists; or specific strings containing a series of numbers, letters, or other characters. Using regular expressions, you’re limited only by your imagination.
Get a Grip on Grep
The grep command looks inside one or several files for the string, or text, you specify. Its syntax is:
grep options search_string file....
At its most basic, you tell grep what to look for and where:
grep AppleTalk /etc/services, for example. Here, you tell grep to look for AppleTalk in the services file located in the /etc directory. (This useful file contains a list of network port numbers for commonly used services.) The command displays each line that contains your search string:
echo 4/ddp # AppleTalk Echo Protocol
at-rtmp 201/udp # AppleTalk Routing Maintenance
at-rtmp 201/tcp # AppleTalk Routing Maintenance
And so on. You can use the familiar asterisk (
*) wild card to have grep search a group of files in the current working directory, as in
grep Walden *. This command searches all the files in the current directory for the word Walden, returning the following:
Binary file Walden.doc matches
pepys_diary.txt:that spoke ill of him, and told me how basely Lionell Walden
Excursions.txt:veil over his experience. All readers of "Walden" will remember his
Walden.txt:purpose in going to Walden Pond was not to live cheaply nor to live dearly
And so on. As the above example shows, the search returns several matches. The first, Walden.doc, is a Word file. The grep command calls such proprietary file types binary files. It can’t display the contents of binary files, but it can search inside them and tell you if something matches. The next examples come from plain-text files, for which grep can display the results. You see the file name, followed by a match of the search string in its context.
You can search for any multiword text string by enclosing the string in single quotes. For example, if you want to search for the phrase Walden Pond,you’d type
grep 'Walden Pond' *.
Note that grep doesn’t like Macintosh line breaks. It returns lines containing the search string, but it doesn’t see Mac line breaks as anything other than characters. In such a case, the “line” it returns is the entire file; this can dump a lot of text into your Terminal window.
In the previous example, grep ran in a specific folder, checking all the files it contained. What if you want to run grep on a folder and its subfolders, or you want grep to look for the string regardless of case? You need to add options. For example, to search for Waldenanywhere in a folder or its subfolders, use the
grep -r Walden ~/Documents/*.
Fine-Tune Your Searches
|To Find…||Use This Option||Example|
|Text in subfolders
grep -r Walden ~/Documents/*
Finds Walden in any file in any subfolder of ~/Documents.
|Whole words only
grep -w live
Finds only live ; does not find liver , lives , lived , and so on.
grep -i pond
Finds pond , POND , or Pond .
|File names only
grep -l Walden
Finds files containing Walden , but returns only a list of file names.
|Number of occurrences only
grep -c Walden
Returns the names of files containing Walden and the number of hits in each file.
The grep command has several options that let you fine-tune the way you search for text, as well as the kind of results grep returns. Get started with the helpful options listed here. (Note that you can also combine options—for instance,
grep -rl Walden searches subfolders and returns only a list of files containing the word Walden .)
Search for Multiple Strings
Using the pipe (
|), a Unix redirection operator, you can tell grep to search for more than one string. Say you want to find files containing both Walden and Pondon the same line. You’d use this command:
grep Walden * | grep Pond. The first part of the command looks for the word Walden in any files in the current directory, and the second runs another grep command on the results of the first command. Terminal displays only the final results of the two commands combined.
You could string together many grep commands, like this:
grep a /usr/share/dict/words | grep e | grep i | grep o | grep u
. This command looks in a special dictionary file for words containing the lowercase letter a. It then looks for words containing e in the results, and so on, finally returning only those words that contain all five vowels.
This function of grep is most useful when you’re searching for specific strings in output from other commands. In this way you can whittle down long and complex output. For example, here’s a common way to find the process ID of a program that’s stuck so you can force-quit it from the command line: type
ps -ax | grep Finder.
This command first gets a list of all processes running on your Mac, and then sifts through this list looking for lines containing the word Finder. For example, your results might be as follows:
390 ?? S 4:18.96 /System/Library/CoreServices/Finder.app/Contents/MacOS/Finder
2292 std R+ 0:00.00 grep Finder
The process ID is the first number on each line; here, the Finder is 390. (You’ll notice the command also returns itself; since the word Finderis in the grep command, that gets listed as well.) So if the Finder is stuck, this gives you the information you need to force-quit it. Now you would type the command (where the process ID is the final argument)
kill -9 390.
Add Regular Expressions to the Mix
While you have seen some of the power of the grep command, you can go much further using regular expressions, special combinations of characters that act as wild cards. Here are a few examples.
If you’re not sure how to spell the word separate, for example (is that an a or an e?), run this command to check the special dictionary file hidden in your Mac’s entrails:
grep ^sep.r.te /usr/share/dict/words
You’ll get back a list of words that includes separate, separately, separately, separateness, and separates.
Note the two special characters in the command: the caret (
^) and the dot (
.). The caret tells grep to search for the string at the beginning of a line, so the results don’t include words like inseparate. The dot matches any character except a new line.
What if you want to find all the phone numbers in a specific file? Try this command, which will find phone numbers in the 555-1234 format:
grep [0-9][0-9][0-9]-[0-9][0-9][0-9][0-9] phonebook.txt
Each of the
[0-9] wild cards matches any character in the range specified in brackets. You can use ranges such as
[1-3] to limit your search to specific strings. This works for letters, too:
[a-n] matches any lowercase character from a to n.You can build your own range with sets of characters—for example,
[aeiou] will match only vowels. You can learn more about regular expressions by typing
man grep in Terminal, or by consulting Jeffrey Friedl’s excellent book Mastering Regular Expressions, second edition (O’Reilly, 2002). With a bit of practice, you’ll be using grep and regular expressions to find anything you want.
Kirk McElhearn is the author of The Mac OS X Command Line: Unix Under the Hood (Sybex, 2004). His blog, Kirkville, has articles and tips on using the command line with Mac OS X. ]