Real-World One-Liners

Break one question into small stages

One-liners are useful for quickly testing search, transformation, and aggregation. Treat these examples as practice in reading what each stage accepts and emits, not as spells to memorize. Confirm the real path and input format, and begin with read-only questions.

Find paths using the most disk space

du -sh ./* 2>/dev/null | sort -h | tail

This prints human-readable summaries, sorts them, and selects the largest entries. If you hide permission errors, record that the result may not represent the whole filesystem.

See the commands used most often in history

fc -l 1 | awk '{print $2}' | sort | uniq -c | sort -rn | head

Results depend on the shell's history format and treatment of multiline commands. Also check that the report does not expose secret values stored in history.

Find the most common IPs in an access log

awk '{print $1}' access.log | sort | uniq -c | sort -rn | head -10

This is correct only when the log contract puts the real client IP in the first field. Proxy headers and quoted formats may require a format-aware parser.

Count lines in Python and JavaScript files

find . -type f \( -name '*.py' -o -name '*.js' \) -print0 |
  xargs -0 wc -l | sort -n

The NUL boundary preserves filenames containing spaces or newlines. Exclude generated and dependency directories when they do not belong in the measurement.

Collect TODOs by file

grep -rn --exclude-dir=.git --exclude-dir=node_modules 'TODO' .

Search results are candidates, not priorities or ownership assignments. Match casing and comment conventions to the project contract.

Find duplicate lines in a file

sort input.txt | uniq -d

Sorting discards the original order. Decide first whether whitespace and case should count as differences, and use a format-aware tool for structured records.

Convert an ISO timestamp to local time

date -j -f '%Y-%m-%dT%H:%M:%SZ' '2026-01-02T03:04:05Z' '+%F %T %Z'

This is the macOS BSD date form. GNU date uses different options, and the command assumes the trailing Z denotes UTC.

Strip ANSI color controls from a captured log

perl -pe 's/\e\[[0-9;]*[A-Za-z]//g' colored.log

This expression does not cover every terminal control sequence. Preserve the original and verify representative samples before trusting the cleaned output.

Find files modified in the last hour

find . -type f -mmin -60 -print

Confirm what modification time means for the workflow and how precise the filesystem timestamps are. Print candidates for review before using this as an automated cleanup condition.

Select URLs from a bookmarks export

jq -r '.bookmarks[].url' bookmarks.json | sort -u

The query depends on the JSON schema. Decide how to handle null and missing fields as part of the input contract.

A one-liner is a tool for testing a hypothesis

A short pipeline is fast for one investigation or temporary report. When it repeats, accepts external input, or mutates state, promote it to a named script with tests. The promotion point is whether you can explain the input contract and failure state, not how short the command looks.

Observe intermediate results

A search-transform-aggregate chain can turn an empty upstream result into a plausible zero. Check row counts and representative samples at each stage, keep errors separate from data, and run irreversible mutations separately from read-only validation.