Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to get the output of files from today which contain "ERROR".

I use this to find the files I want:

find /home/user/logfilesError/ -maxdepth 1 -type f -name "gandalf_*"\
   -daystart -mtime -1 -exec grep -rl "ERROR" "{}" +

Current output (if ERROR found):


But the output I want is only the logfile name:


Info: The path changes often so I can't just cut the letters before.

Thanks for your help!

share|improve this question
I think the grep -rl especially the -l stops after at the first match – BlueFox Jun 18 '14 at 10:20
I edited my answer. How to output the answers separated by a comma is a different question. I think the answer has already been given somewhere. One way to do it is to pipe your output to awk 'BEGIN {ORS=", "} ; {print} ; NR=$NR { ORS="\n" }' – lgeorget Jun 18 '14 at 11:22
up vote 2 down vote accepted

The basename tool can strip the path before the filename.

find /home/user/logfilesError/ -maxdepth 1 -type f -name "gandalf_*"\
-daystart -mtime -1 -exec grep -rl "ERROR" "{}" + | xargs -n 1 basename

will give you the desired output.

-n 1 tells xargs to use exactly one argument for basename. So if it receives more, it will spawn one basename process per argument. This is needed as basename takes only one filename as argument.

This command will NOT work if your filenames contain spaces. In this case, as suggested by @HaukeLaging, use :

find /home/user/logfilesError/ -maxdepth 1 -type f -name "gandalf_*"\
-daystart -mtime -1 -exec grep -rl "ERROR" "{}" + | xargs -n 1 -d \\n basename

This will not work if your filenames contain newlines, though.

share|improve this answer
xargs -d \\n basename – Hauke Laging Jun 18 '14 at 9:22
@HaukeLaging Coool, how comes -d is not documented in the man page? – lgeorget Jun 18 '14 at 9:26
It is (and "always" has been) in mine... (--delimiter=delim, -d delim) – Hauke Laging Jun 18 '14 at 9:30
Thanks! I didnt thought it would be so easy! – BlueFox Jun 18 '14 at 9:30
@HaukeLaging Well... just figured out, I was looking at my localized (french) man page, which is apparently not up-to-date. – lgeorget Jun 18 '14 at 9:32

If ./gandalf_123.log is OK for you then you can use

find /home/user/logfilesError/ -maxdepth 1 -type f -name "gandalf_*"\
  -daystart -mtime -1 -execdir grep -rl "ERROR" "{}" +

Otherwise I would pipe the grep output through e.g. sed in order to delete the unwanted part:

> echo /home/user/logfilesError/gandalf_123.log |
  sed 's+.*/++'
share|improve this answer

You can use sed:

... | sed -e 's=.*/=='

Which tells it to replace anything up to a / with nothing.

You can also use cut, but it can't count from the right, so you have to combine it with rev:

... | rev | cut -d/ -f1 | rev
share|improve this answer

this can be done with

 echo ${str##*/}

which will trim the string from left to right until last '/'

> str=/home/user/logfilesError/gandalf_123.log
> echo ${str##*/}
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.