<b>Status-code mining with one-liners: the awk greatest hits</b>

<b>Status-code mining with one-liners: the awk greatest hits</b>
Four snippets worth pinning above your terminal, all credited to where I first saw them.

🔗 <b>Julia Evans (wizardzines)</b> — her awk explainers make <code>awk '{print $9}' | sort | uniq -c | sort -rn</code> finally click. Best mental model for field-splitting logs.
🔗 <b>nixCraft</b> — classic tutorial for isolating 5xx by hour: <code>awk '$9~/^5/{print substr($4,14,2)}'</code>. Find the spike, then the cause.
★ <b>Pick of the week — Brendan Gregg's "awk and the log" notes</b> — treats logs as columnar data and shows running-tally tricks (associative arrays) that beat piping to sort.
🔗 <b>Greg's Wiki (BashFAQ)</b> — the quoting and field-number gotchas that save you from off-by-one column bugs.

Takeaway: 90% of log triage is field 9 (status) grouped by something. Master that, skip the heavy tools.