The short answer is yes, there is a way. Now, how to do it, depends on how you want to define your threshold What I mean is, you can (below are just some ideas to get you going... these may not all be working samples) use Standard Deviation (http://docs.splunk.com/Documentation/Splunk/6.5.0/SearchReference/CommonStatsFunctions) index=ui "webui03" "production_in_one_line.log" "Services::UploadController" earliest=@d | timechart span=1h avg(duration) as hourly_avg | stats latest(hourly_avg) as hourly_avg stdev(hourly_avg) as hourly_stdev | where hourly_avg>hourly_stdev*2 OR, you can use trendline (https://docs.splunk.com/Documentation/Splunk/6.5.0/SearchReference/Trendline) index=ui "webui03" "production_in_one_line.log" "Services::UploadController" earliest=@d | timechart span=1h avg(duration) as hourly_avg | trendline sma2(hourly_avg) as trend | stats latest(duration) as latest latest(trend) as trend | where latest>trend*1.5 OR, a simple mean over time index=ui "webui03" "production_in_one_line.log" "Services::UploadController" earliest=@d | timechart span=1h max(duration) as max_duration | eventstats avg(duration) as avg_duration | where max_duration>avg_duration*2 ... View more