Looking at the results from a popular web analytic site, their definition of "current visitors" seems to be "distinct count over rolling five minutes". I'd like to replicate that in Splunk, but I couldn't find an elegant way to keep a rolling dc for five minute blocks without starting over. You could simply say timechart span=5m dc(clientip) but that's not quite the same thing, as I would like a bar per minute that represents the previous 5 minutes.
I've come up with a query that works, but I'm hoping someone more clever than I can shorten this query a bit. Maybe there's a timechart function I'm missing, or a range function of some sort that would shorten the eval, or a weird use of streamstats: