Substitute functions

The substitution functions change parts of lines selected by a context search within the line, using the syntax:

[address]s/pattern/replacement/flags

The s function replaces part of a line selected by the designated pattern with the replacement pattern. This is similar to vi (see ``A quick tour of vi''). The substitution is restricted to only those lines matching the optional address. The pattern argument contains a pattern, exactly like the patterns in addresses. The only difference between a pattern and a context address is that a pattern argument may be delimited by any character other than space or newline. By default, only the first string matched by the pattern is replaced, except when you use the g flag.

The replacement argument begins immediately after the second delimiting character of the pattern, and must be followed immediately by another instance of the delimiting character.

The replacement is not a pattern, and the characters that are special in patterns do not have special meaning in replacement. Instead, the following characters are special:

&

This character is replaced by the string that matches the pattern. For example:

s/fruit/fresh & and vegetables/

This command substitutes the word ``fruit'' with ``fresh fruit and vegetables''.

\d

d is a single digit that is replaced by the dth substring matched by parts of the pattern enclosed in ``\('' and ``\)''. If nested substrings occur in the pattern, the dth substring is determined by counting opening delimiters.

/\(foo\)\(bar\)/\2\1/

This substitution consists of a regular expression in two groups; ``foo'' and ``bar''. If applied to a line containing the word ``foobar'' the regular expression matches each of the grouped subexpressions in turn. The replacement argument ``\2\1'' transposes the order of the first two grouped expressions that sed matched, producing the following output:

barfoo

A flag argument can contain the following:

g

Global. Substitutes the replacement for all non-overlapping instances of the pattern in the line. After a successful substitution, the scan for the next instance of the pattern begins just after the end of the inserted characters; characters put into the line from the replacement are not rescanned.

The following example replaces all occurrences of the word ``password'' with a string of x's:

s/password/xxxxxxx/g

n

Causes the substitution to be performed only on the nth instance of a matching string. For example:

s/Current/Expired/2

This command substitutes the second instance of ``Current'' in each input line with ``Expired''. The default value of n is 1, which is why a substitution operation specified without the global flag affects only the first instance of a matching string (see the examples in ``Context addresses''). The maximum value of n is 512.

p

Prints the line if a successful replacement was done. The p flag causes the line to be written to the output only if a substitution was actually made by the s function. Note that if several s functions, each followed by a p flag, successfully substitute in the same input line, multiple copies of the line are written to the output (one for each successful substitution). For example, s/password/xxxxx/gp globally replaces ``password'' with x's and prints the results.

w file

Writes (appends) the line to a file if a successful replacement was done. The w flag causes lines that are actually substituted by the s function to be written to the named file. If the filename existed before you run sed, it is overwritten; if not, the file is created. A single space must separate w and the filename. The possibilities of multiple different copies of one input line being written are the same as for the p flag. A combined maximum of ten different filenames can be specified after w flags and w functions.

Here are some examples of the commands in use. When applied to the /etc/passwd file used previously, /charlie/s/charlie/charles/w changes sends the following to standard output:

   root:x:0:0:Superuser:/:
   remacc:x:::Remote access::
   daemon:No login:1:1:Spooler:/usr/spool:
   sys:No login:2:2:System information::
   bin:x:3:3:System administrator:/usr/src:
   xmail:x:4:4:Secret Mail:/usr/spool/pubkey:
   msgs:No login:7:7:System messages:/usr/msgs:
   charles:x:8:5:Charles Stross:/usr/charlie:/bin/ksh

   charles:x:8:5:Charles Stross:/usr/charlie:/bin/ksh

The following is a shorthand version of the same command:

/charlie/s//charles/w changes

In this case, the context address is the same as the string to be substituted. In this case, sed assumes that the value of the null field is the same as that of the preceding (address) field.

The command s/:/\<Tab>/gp (where <Tab> is a typed tab character) replaces all colons with tabs in a data file, and prints the result (for example, as input to an awk program).

Note that where a substitution command involves a literal backslash, it must be quoted, as follows:

$ sed -e "s/<Tab>/\\\\/gp" input_file

This replaces all the tabs in the input file with a single backslash. Note also the following:

$ sed -e 's/<Tab>/\\/gp' input_file

This has the same effect. The difference between the two quoting mechanisms is that the double quotes prevent the expansion of all special characters except the backslash, the dollar sign and the single quote.

Note that it is not essential that the character used to separate the fields in the substitute command always be a slash. Consider the case where a pathname is to be substituted with another pathname. In such a case, the slashes in the pathname substitution strings conflict with those used to build up the command itself. This can be avoided by using another string as the delimiter character. The following example uses the exclamation mark (!) to specify a substitution command where the affected strings are pathnames:

s!/dev/null!/dev/stdout!gp