Linux cut Command Explained: Extract Any Field, Column, or Character in Seconds

Cut Command in Linux: The Fastest Way SOC Analysts Slice Through Log Noise

Quick Answer: The Linux cut command extracts specific characters, bytes, or delimited fields from each line of text — making it one of the fastest tools for pulling usernames, IPs, or CSV columns out of raw logs during triage.

Last verified: September 2026

It's 2 a.m. and a SOC analyst is staring at a firewall export with 40,000 lines, each packed with timestamps, source IPs, destination ports, and protocol flags jammed into one column-heavy blob. There's no SIEM parser configured for this feed yet, and the incident commander wants a list of every unique source IP hitting the perimeter in the next five minutes. Opening this in a spreadsheet would take longer than the compromise itself. This is exactly the kind of moment where cut — one of the oldest, least glamorous utilities in Linux — earns its place in a working analyst's toolkit.

cut won't detect malware and it won't correlate events across hosts. What it does is strip a line down to exactly the piece you need — a column, a character range, a single field — instantly, on the command line, with no scripting required. For anyone doing enterprise log analysis or building lightweight SOC automation without a full SIEM log parsing pipeline, that's a genuinely high-leverage skill.

Table of Contents

• What the cut Command Actually Does
• Cutting by Character and Byte
• Cutting by Field and Delimiter
• Real-World SOC Use Case: Parsing /etc/passwd and Network Output
• Command Reference Table
• Where cut Fits in Detection and Defensive Workflows
• Expert Tips
• FAQ
• Conclusion

What the cut Command Actually Does

cut is a POSIX text-processing utility that reads input line by line and prints back only a defined slice of each line — selected by character position, byte position, or delimited field number. It reads from a file argument or from standard input, which means it chains naturally into pipelines with cat, grep, awk, or the output of any command.

The basic syntax is:

cut [OPTION]... [FILE]...

Only one of -c, -b, or -f can be used per invocation — you pick one mode of slicing, not a combination.

Cutting by Character and Byte

When your data doesn't have a clean delimiter — fixed-width logs, padded output, legacy formats — position-based cutting is the right tool.

Cut by character position:

cut -c1-5 file.txt

This prints characters 1 through 5 of every line. It's useful when a log format has a known fixed-width prefix, like a severity code or a status flag, that always sits in the same position.

Cut by byte position:

cut -b1-10 file.txt

Functionally similar to -c for ASCII text, but operates on raw byte offsets. This matters when a file has multi-byte or non-UTF-8 encoded content, where character and byte boundaries diverge.

Open-ended ranges are supported on both sides:

cut -c3- file.txt   # from the 3rd character to the end of the line
cut -c-5 file.txt   # from the start through the 5th character

Multiple ranges in one call:

cut -c1-3,7-10 file.txt

This grabs characters 1–3 and 7–10 from every line and prints them together — handy for pulling two non-adjacent fields out of a fixed-width record in a single pass instead of chaining two commands.

Cutting by Field and Delimiter

Most real analyst work involves delimited data — CSV exports, colon-separated system files, comma- or space-separated command output — and this is where -f combined with -d does the heavy lifting.

Cut a single field:

cut -d',' -f2 file.txt

Extracts the second comma-delimited field from each line. Change -d',' to whatever separator the data actually uses.

Cut multiple, non-adjacent fields:

cut -d':' -f1,3 /etc/passwd

Pulls fields 1 and 3 (username and UID) from /etc/passwd, comma-separating them in the same original delimiter by default.

Cut a field range:

cut -d':' -f1-3 /etc/passwd

Grabs fields 1 through 3 in one continuous block.

Open-ended field ranges work the same way as character ranges:

cut -d',' -f3- file.csv

Extracts the third field and everything after it — useful when trailing columns vary in count but you only care about a stable starting point.

Tab-delimited data needs an explicit ANSI-C quoted tab, since a literal tab is easy to mistype on the command line:

cut -d$'\t' -f2 file.txt

Real-World SOC Use Case: Parsing /etc/passwd and Network Output

/etc/passwd is one of the most common files an analyst touches during a Linux host review, and it's colon-delimited by design — a natural fit for cut.

List usernames:

cut -d':' -f1 /etc/passwd

Field 1 is the username. This is often the first step in spotting an unauthorized account created during a compromise — a quick cut plus sort or wc -l gives an analyst a fast account inventory without opening the file in an editor.

List home directories:

cut -d':' -f6 /etc/passwd

Field 6 shows each user's home directory — useful for cross-checking whether a suspicious account has an unusual home path, like one pointing outside /home.

Pull the login shell (often the last field):

cut -d':' -f7 /etc/passwd

An account with an interactive shell (/bin/bash) that should have /usr/sbin/nologin is a classic persistence indicator worth flagging in an incident timeline.

Extracting IPs from command output:

ip -4 addr | cut -d' ' -f1

Piping ip -4 addr straight into cut with a space delimiter is a common one-liner during live host triage, when an analyst needs interface data fast without parsing the full verbose output by eye.

Working with CSV exports — a near-daily task when pulling data from a SIEM, ticketing system, or asset inventory:

cut -d',' -f1 file.csv        # first column
cut -d',' -f2,4 file.csv      # second and fourth columns
cut -d',' -f2-4 file.csv      # columns two through four
cat users.csv | cut -d',' -f1,3

That last example — piping cat into cut — is a habit worth breaking once you're comfortable, since cut users.csv alone does the same job without the extra process. It still works, and you'll see it constantly in other people's scripts, so it's worth recognizing even if you write it more directly yourself.

And from raw command output directly:

echo "name,age,city" | cut -d',' -f2

Command Reference Table

Command	Purpose
cut -c1-5 file.txt	Characters 1–5 of each line
cut -b1-10 file.txt	Bytes 1–10 of each line
cut -d',' -f2 file.txt	Second comma-delimited field
cut -d':' -f1,3 /etc/passwd	Fields 1 and 3 from /etc/passwd
cut -d':' -f1-3 /etc/passwd	Fields 1 through 3
cut -c3- file.txt	3rd character to end of line
cut -c-5 file.txt	Start through 5th character
cut -c1-3,7-10 file.txt	Two non-adjacent character ranges
cut -d$'\t' -f2 file.txt	Second field, tab-delimited
ip -4 addr | cut -d' ' -f1	First space-delimited field from command output

Where cut Fits in Detection and Defensive Workflows

cut is a triage accelerant, not a detection engine — but it plugs directly into the kind of manual log review that still happens whenever automated tooling hasn't caught up to a new data source. A few practical patterns:

• Rapid IOC extraction: pulling just the IP or hostname column out of a raw connection log so it can be pasted into a threat-intel lookup or an endpoint detection and response platform's search bar.
• Account hygiene checks: combining cut -d':' -f1,7 /etc/passwd with a quick visual scan to catch shells that shouldn't be interactive — a lightweight complement to more formal enterprise vulnerability management reviews.
• Pre-processing for scripts: feeding cut output into sort -u, wc -l, or a loop, when writing a quick one-off script rather than standing up full SOC as a service tooling for a one-time data pull.

According to general Unix documentation on the utility, cut only supports one selection mode per invocation — so more complex extraction logic (conditional columns, regex-based splitting) belongs to awk instead. Analysts who lean on cut for the simple 80% of cases and reach for awk only when the logic actually gets conditional tend to write faster, more readable one-liners under pressure.

Expert Tips

• Always confirm the actual delimiter before running cut -d blind — a file that looks comma-separated may actually mix commas and semicolons, silently breaking field counts.
• Pair cut with sort -u to deduplicate extracted values, e.g., cut -d':' -f1 /etc/passwd | sort -u, for a clean unique-account list during a host audit.
• When output looks misaligned, check whether the source used tabs vs. spaces — the most common cause of a field extraction silently returning the wrong column.
• For anything beyond a single fixed delimiter or when fields need conditional logic, move to awk '{print $2}' rather than fighting cut's single-mode limitation.

Related Cybersecurity Topics You Should Explore

• FortiGate CVE-2025-25249 Exploited to Deploy PivotC2 RAT — Patch Now
  
• Critical Dell SCG Bug (CVSS 9.8) Grants Root Access — Patch Now
  
• WeWorm: Zero-Click WeChat Worm Hijacks 1.4B Accounts via Call
  
• US Offers $10 Million for Iranian Hacker Behind Critical Infrastructure Attacks
  
• Panzer Ransomware Targets Italian Manufacturers With ESXi-Ready Malware
  
• BigBear 2.0 Evilginx2 Phishing Bypasses Microsoft 365 MFA With Session Cookie Theft
  
• Veradigm Data Breach: How a Stolen Vendor Login Exposed Patient SSNs
  
• Hackers Hide Windows Backdoor Inside HiveMQ and Element Chat
  
• Plex Emailed Users Over Hidden Security Flaws — Update Now
  
• TP-Link Archer AX55 Flaws Let Hackers Steal Admin Access

FAQ

Q: Can cut handle multiple delimiters in the same file?
No — cut takes exactly one delimiter character per invocation. Mixed-delimiter data needs awk or a pre-processing step with sed.

Q: What happens if a line doesn't contain the delimiter?
By default, cut still prints the full line unchanged. Use the -s flag if you want lines without the delimiter suppressed instead.

Q: Is cut safe to run on production log files?
Yes — cut is read-only by nature; it never modifies the source file, only prints selected output to standard out.

Q: Does cut work with piped command output, not just files?
Yes, and this is one of its most common uses in live triage — piping the output of ip, ps, ls, or any other command directly into cut.

Q: Why does my cut -d',' command return the whole line instead of one field?
This usually means the actual delimiter isn't a comma — check for tabs, semicolons, or multiple spaces before assuming the file format.

Conclusion

cut will never replace a SIEM or a proper log-parsing pipeline, and it isn't trying to. What it does is turn a messy wall of text into exactly the column an analyst needs, in one line, with zero setup — which is precisely why it's survived on every Unix-like system for decades. Learning its handful of options well enough to reach for them instinctively during triage is a small investment that pays off every time raw text stands between an analyst and an answer.

Analysis based on SOC monitoring and public Linux systems administration reference review.