Explain sed code

What this sed sample shows

addresses

A command can start with an address that picks the lines it runs on. /^[[:space:]]*#/d deletes every line whose first non-space character is #, and d also stops work on that line, so a deleted line never reaches the later commands. Every other line runs through each command from the top, in order.

substitution

s/old/new/ replaces the first match on each line, and g at the end replaces every match. On a line with two dates, the script rewrote both; the same command without g rewrote only the first and left 2026-11-30 as it was.

capture groups

Brackets in the pattern save what they match, and \1, \2 and \3 put it back in the replacement, so the year, month and day come back in a new order. -E turns on extended regular expressions, where plain brackets capture and {4} means four times. Run without -E, sed stopped with invalid reference \3 on 's' command's RHS.

ranges

/^\[server\]/,/^\[/ picks every line from [server] to the next line that starts with [, and ! turns it around, so !d deletes everything outside that range. When [server] was the last section, the range ran to the end of the file.

Good to know

• Run with GNU sed 4.10 on a 13-line settings file, the script printed 7 lines: [server], host = example.internal, port = 8080, api_token = [hidden], db_password = [hidden], started = 05/11/2026 09:14 and [logging].
• [logging] is still in the output because a range includes the line that ends it. That line starts with [, so it closes the [server] range and is kept with it.
• sed -i writes the result back over the file instead of printing it, and -i.bak first keeps the original as settings.conf.bak. Run on a copy, -i with no suffix left no way back to the comments.

Watch out: [a-z_]+ and (token|password) only match lowercase letters, so a line written API_TOKEN = abc came through as API_TOKEN = abc, with the secret showing and no error. Adding GNU sed's I flag after the last slash makes the match ignore case, and then it printed API_TOKEN = [hidden].