Methods and systems for dynamic, rules-based peg counting are disclosed. According to one method, a user creates peg counter definitions using a rules-based language accessible via a graphical user interface. The peg counter definitions are downloaded from an administration server to network monitoring site collectors. The site collectors automatically detect the new peg counter definitions and begin using the new peg counter definitions without ceasing existing peg counting. Peg counter software on the site collectors periodically sends peg counter instances to a data gateway server. The data gateway server aggregates the peg counter instances generated by the various site collectors into system wide peg counter instances.