evmsort - Sorts events
evmsort [-A] [-s sort_spec] [-t show_template] [filename | -]
-A Automatically starts evmshow to produce a formatted display of the
The specification to be used in sorting events. See the DESCRIPTION
section for the syntax of the sort_spec, and for details of the default
Template string to be passed to evmshow if the -A option is also speci-
fied. If the -A option is not specified, this argument is ignored. See
the evmshow(1) reference page for a description of the template string.
Reads event sources from filename. If filename is omitted, or is speci-
fied as -, event sources are read from stdin.
The evmsort command reads and sorts a stream of EVM events. By default,
events are read from stdin, and are sorted into ascending timestamp order.
Sorted events are written to the command's stdout stream in the form of raw
The sort order can be specified by supplying a sort_spec, either through
the -s option or by setting the environment variable EVM_SORT_SPEC to the
required specification. The specification is a character string of the
@key_item[+|-] [ :@key_item[+|-] ]
The key_item is the name of any EVM standard data item and the @ character
is optional. If the special key_item @@ is specified, the event's format
data item is expanded as described in the evmshow(1) reference page, and
the resulting string is used as the sort key.
The optional trailing + or - character indicates ascending (+) or descend-
ing (-) sort. By default, items are sorted in ascending order.
Multiple items can be specified in the string by separating them with colon
characters (:). The left-most key_item in the specification is the most
If a key_item that is included in the sort specification is not present in
an event read from the input stream, the item is considered to have a low
value for that event. For example: if input events are being sorted in
ascending order according to their name data items, and one event does not
contain a name, that event will appear first in the output stream.
If the -A option is specified, evmsort automatically starts evmshow and
pipes the sorted event stream into it, producing a sorted and formatted
display of events. If a show_template argument is supplied, the specified
template string is passed to evmshow through its own -t option. See the
evmshow(1) reference page for more information.
The evmsort command rejects attempts to output raw events to a terminal
The following exit values are returned:
0 Successful completion
An error occurred
1. The following example retrieves all events with a priority of 300 or
greater, sorts them into descending order of priority (most urgent
first) and then ascending order of time (oldest first), and automati-
cally runs evmshow to display them.
evmget -f '[priority >>= 300]' | evmsort -s "@priority-:@timestamp" |
evmshow -t "@priority @timestamp @@"
2. The following example yields a list of all events, sorted latest first
evmget | evmsort -s "@name:@timestamp-" |
evmshow -t "@name @timestamp @@"
3. The following example yields a list of all events, sorted first in
order of their formatted messages and then in ascending order of time.
Events are passed to evmshow for display, and subsequently to the more
command for viewing.
evmget | evmsort -A -s "@@:@timestamp" -t "@timestamp @@" | more
The following environment variables affect the execution of evmsort:
This variable contains a string formatted as described for a sort_spec.
If the -s option is omitted, the string is used as the sort_spec.
Commands: evmget(1), evmpost(1), evmshow(1), evmwatch(1)
Event Management: EVM(5)
EVM Events: EvmEvent(5)
Event Filter: EvmFilter(5)