[rrd-users] Struggling with rrdtool graph function.

[Simon Hobson]

OK, here goes for some hints ...

The basic bit you need is the IF statement, which is basically a,b,c,IF, which means IF <a is true> then return value b else return value c.
So lets start by throwing away anything after (say) 6pm :
<timestamp > 6pm>,UNKN,x,IF
where x is a DEF defined earlier.

Now we can throw away anything before 8am :
<timestamp is <= 8am>,UNKN,y,IF
where in this case, y should be the result of the above calculation.

RPN (http://oss.oetiker.ch/rrdtool/doc/rrdgraph_rpn.en.html, http://en.wikipedia.org/wiki/Reverse_Polish_notation) is great in that we can build arbitrarily complex expressions without needing brackets or having to rely on operator precedence to remove ambiguity. So we just insert the first expression in place of y and get :
<timestamp is <= 8am>,UNKN,<timestamp > 6pm>,UNKN,x,IF,IF

You can repeat the process if you also want to select specific days of the week.
Now all you need to do is read the documentation and work out the expressions to compare the time of day against your cutoff times. I'm sure someone will chip in, but the only way I can see it working is like this :
<timestamp is <= 8am>
x,LTIME,86400,%,3600,*,8,LE
or
x,LTIME,86400,%,28800,LE

Similarly, >6pm would be
x,LTIME,86400,%,64800,GT

And plugging all that together, gives :
x,LTIME,86400,%,28800,LE,UNKN,x,LTIME,86400,%,64800,GT,UNKN,x,IF,IF

When faced with such an expression, it is to say the least daunting ! If I need to reverse engineer it into something I can comprehend, I'll work through it left to right, putting brackets round blocks :
(((x,LTIME),86400,%),28800,LE),UNKN,x,LTIME,86400,%,64800,GT,UNKN,x,IF,IF
here I've brocken it down and it's easy to see that the first LTIME consumes the x and leaves a single value on the stack in it's place. Then the 86400,% takes that value, gets the modulo of it with one day, and leaves the result (which is nos the number of seconds after midnight) on the stack. Then the 28800,LE takes that value and leaves a true/false on the stack to say if the time is on or before 8am.
A slightly different version (and removing the brackets from inner blocks I'm no longer interested in) shows the operands used by the last IF on the line :
(x,LTIME,86400,%,28800,LE),UNKN,(x,LTIME,86400,%,64800,GT,UNKN,x,IF),IF
and here we can se that for a,b,c,IF, a=x,LTIME,86400,%,28800,LE, b=UNKN, and c=x,LTIME,86400,%,64800,GT,UNKN,x,IF
Of course, this is just how my mind works, others handle these situations differently.

If RPN is still looking 'wierd', then there are plenty of explanations and tutorials on the net.