In C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows\local\inputs.conf:
[perfmon://Network Interface]
counters = Bytes Received/sec;Bytes Sent/sec
instances = *
interval = 10
object = Network Interface
index = wmi
SplunkWeb Query:
earliest=-1d host=MyHost sourcetype="Perfmon:Network Interface" | eval MB_Usage=10*Value/1024/1024| timechart span=1h sum(MB_Usage)
(multiplying by 10 because interval=10 and WMI metric is Bytes/sec?)
Would that give me MB Usage by hour for the given host?