Hi aluetjen, here are some run everywhere examples for the messages sent per minute per queue index=_internal earliest=-15m@m | timechart span=1m count by series index=_internal earliest=-15m@m | timechart span=1m sum(kbps) AS mySum by series and if you want to use delta on this index=_internal earliest=-15m@m | bucket _time span=1m | stats count AS myCount by series, _time | delta myCount index=_internal earliest=-15m@m | bucket _time span=1m | stats sum(kbps) AS mySum by series, _time | delta mySum The count examples will give you a total count of events for each series and the sum example will sum the values of the given field, in this case kbps of each series. hope this helps to get you started ... cheers, MuS ... View more

I used WMI inputs to query performance counters (including the NSB ones) successfully. Example from http://blogs.splunk.com/2008/04/29/wmi-comes-to-splunk/ [WMI:LocalAllProcesses] namespace = \.\root\cimv2 interval = 30 wql = select * from Win32_PerfFormattedData_PerfProc_Process disabled = 0 I used the following steps: Discover the appropriate counter using 'CIM Studio' http://www.microsoft.com/en-us/download/details.aspx?id=24045 Test in a PowerShell prompt Get-WmiObject -Query "select * from Win32_PerfFormattedData_PerfProc_Process" Take exactly that query into your WMI input in Splunk. Sorry, I don't have the NSB specific example handy. ... View more

Did you ever find out any more info on this? I'm having the same issue, solved by a restart. ... View more