When using DTrace to build simple monitoring scripts, you can periodically clear the values in an aggregation by using the clear function. This function takes an aggregation as its only parameter. The clear function clears only the aggregation's values, while the aggregation's keys are retained. Therefore, the presence of a key in an aggregation that has an associated value of zero indicates that the key had a non-zero value that was subsequently set to zero as part of a clear. To discard both an aggregation's values and its keys, use the trunc function. See Section 3.7, “Truncating Aggregations”.

The following example uses clear to show the system call rate only for the most recent ten-second period:

#pragma D option quiet

BEGIN
{
  last = timestamp;
}

syscall:::entry
{
  @func[execname] = count();
}

tick-10sec
{
  normalize(@func, (timestamp - last) / 1000000000);
  printa(@func);
  clear(@func);
  last = timestamp;
}