How do I replace the following string


with john.doe

Basically I need to look for the last colon (:) and delete everything before and including it.


Assuming what you actually mean is that you want to delete everything up to the last colon and leave the john.doe intact:

echo 'hd_ma_prod_customer_ro:*:123456789:john.doe' |
  sed 's/.*://'


First line just pipes the test string to sed for example purposes.

The second is a basic sed substitution. The part between the first and second / is the regex to search for and the part between the second and third is what to replace it with (nothing in this case as we are deleting).

For the regex, . matches any character, * repeats this any number of times (including zero) and : matches a colon. So effectively it is anything followed by a colon. Since .* can include a colon, the match is 'greedy' and everything up to the last colon is included.

sed -r 's/:/\t/g' filename | awk -F'\t' '{print $4}'

I am replacing all the occurrences of : with a tab and then using awk to extract the string john.doe.

If you do not have a file you can try this.

echo 'hd_ma_prod_customer_ro:*:123456789:john.doe' | sed -r 's/:/\t/g' | 
awk -F'\t' '{print $4}'

As per Graeme's comments we can use awk to print the last column alone using the NF variable of awk as below.

echo 'hd_ma_prod_customer_ro:*:123456789:john.doe' | sed -r 's/:/\t/g' | awk -F'\t' '{print $NF}'

Incorporating Graeme's comments to get rid of unnecessary sed

The command can be modified as below.

echo 'hd_ma_prod_customer_ro:*:123456789:john.doe' | awk -F':' '{print $NF}'
  • 1
    If you are going to use awk, why not just do awk -F:?
    – Graeme
    Jun 12 '14 at 16:37
  • @Graeme, I am still not that comfortable with awk. Basically, I try to test the commands that I originally got in my answer and try to modify them according to the user's requirement. :)
    – Ramesh
    Jun 12 '14 at 16:39
  • 3
    The -F option for awk specifies the field separator. If you tell awk to use a colon, there is no need to replace the colons with tabs. Also, if you want to get the last field you can use $NF instead of $4, this would then work if there is not always 3 colons.
    – Graeme
    Jun 12 '14 at 16:44
  • @Graeme, I have incorporated the changes you have mentioned. Please let me know if this is fine :)
    – Ramesh
    Jun 12 '14 at 17:29
  • Yes, works perfectly!
    – Graeme
    Jun 12 '14 at 17:31

Another method using awk:

awk -F: '{ print $NF }'

Please try

edit: removed anchor

echo 'abc:fjk' |sed 's/.*:/john.doe/g'

and to delete

echo 'abc:fjk' |sed 's/.*://g'
  • that's not what the OP's asking for
    – iruvar
    Jun 12 '14 at 16:34
  • please re-read the question again.
    – akash
    Jun 12 '14 at 16:37
  • Well you snuck in the delete after my comment, never mind
    – iruvar
    Jun 12 '14 at 16:39
  • oh i see . my apologies 1_CR
    – akash
    Jun 12 '14 at 16:40
  • 1
    The ^anchor makes no difference in either the question's case or in your example case. Any address beginning with /.* already implies the ^.
    – mikeserv
    Jun 13 '14 at 3:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.