Detect server response time outliner

[indeed_2000]

Hi

I have field in my log that call ServerRespTime. I want to detect outliner of ServerRespTime.

Here is the conditions:

1-under 0.05 is normal ServerRespTime

2-upper 0.05 (if continue for couple of seconds) is abnormal  ServerRespTime

any idea?

 Thanks,