When looking at aggregation results, you often care only about the top several results. The keys and values that are associated with anything other than the highest values are not of interest. You might also choose to discard an entire aggregation result, removing both the keys and values. The DTrace trunc function is used in both of these situations.

The parameters to trunc are an aggregation and an optional truncation value. Without the truncation value, trunc discards both the aggregation values and the aggregation keys for the entire aggregation. When a truncation value n is present, trunc discards the aggregation values and keys, except for those values and keys that are associated with the highest n values. That is to say, trunc(@foo, 10) truncates the aggregation named foo after the top ten values, where trunc(@foo) discards the entire aggregation. The entire aggregation is also discarded if 0 is specified as the truncation value.

To see the bottom n values instead of the top n values, specify a negative truncation value to trunc. For example, trunc(@foo, -10) truncates the aggregation named foo after the bottom ten values.

The following example displays only the per-second system call rates of the top ten system-calling applications in a ten-second period:

#pragma D option quiet

BEGIN
{
  last = timestamp;
}

syscall:::entry
{
  @func[execname] = count();
}

tick-10sec
{
  trunc(@func, 10);
  normalize(@func, (timestamp - last) / 1000000000);
  printa(@func);
  clear(@func);
  last = timestamp;
}

The following example shows the output from running the previous script on a lightly loaded system:

# dtrace -s truncagg.d 

  dbus-daemon                                                       0
  NetworkManager                                                    1
  gmain                                                             1
  systemd-logind                                                    1
  sendmail                                                          1
  systemd                                                           1
  httpd                                                             2
  tuned                                                             5
  dtrace                                                           44

  rpcbind                                                           0
  dbus-daemon                                                       0
  gmain                                                             0
  sshd                                                              1
  systemd-logind                                                    1
  sendmail                                                          1
  systemd                                                           1
  httpd                                                             2
  tuned                                                             5
  dtrace                                                           41

  dbus-daemon                                                       0
  gmain                                                             1
  sshd                                                              1
  systemd-logind                                                    1
  sendmail                                                          1
  systemd                                                           1
  httpd                                                             2
  tuned                                                             5
  automount                                                         7
  dtrace                                                           41
^C

#