A computer-implemented method for detecting anomalies in a performance metric associated with computer application transactions in a distributed computing environment, comprising: - receiving, by a transaction classifier residing on a given server computer a plurality of previous transaction events resulting from computer application transactions executed during an overall observation period, where each transaction event is derived from a given transaction and each transaction event includes a performance metric indicative of transaction execution and all of the previous transaction events fall into a given category; - segmenting the plurality of previous transaction events into observations windows, where each observation window is a fixed period of time within the overall observation period; characterized in that: - for each observation window in the overall observation period, determining by a category filter residing on the given server computer a number of all transaction events in a given observation window; - for each observation window in the overall observation period, creating a window reference record in a data repository, where each window reference record includes a representative value for the performance metric during the given observation window and the number of all transaction events in the given observation window is stored as a transaction load during the given observation window; - determining by an overall reference data extractor residing on the given server computer and interfaced with the sliding window data repository a function that describes dependency between the representative value for the performance metric and the transaction load, where the representative value for the performance metric and the transaction load from the window reference records serve as data points for the function; - storing the function as overall statistical reference data for the given category and the given overall observation period; - receiving a particular transaction load for the given category during a current observation period, where the current observation period occurred more recently than the overall observation period; and - evaluating the function using the particular transaction load as a parameter, thereby yielding a reference value for the performance metric during the current observation period. - receiving, by a transaction classifier residing on a given server computer a plurality of previous transaction events resulting from computer application transactions executed during an overall observation period, where each transaction event is derived from a given transaction and each transaction event includes a performance metric indicative of transaction execution and all of the previous transaction events fall into a given category; - segmenting the plurality of previous transaction events into observations windows, where each observation window is a fixed period of time within the overall observation period; - for each observation window in the overall observation period, determining by a category filter residing on the given server computer a number of all transaction events in a given observation window; - for each observation window in the overall observation period, creating a window reference record in a data repository, where each window reference record includes a representative value for the performance metric during the given observation window and the number of all transaction events in the given observation window is stored as a transaction load during the given observation window; - determining by an overall reference data extractor residing on the given server computer and interfaced with the sliding window data repository a function that describes dependency between the representative value for the performance metric and the transaction load, where the representative value for the performance metric and the transaction load from the window reference records serve as data points for the function; - storing the function as overall statistical reference data for the given category and the given overall observation period; - receiving a particular transaction load for the given category during a current observation period, where the current observation period occurred more recently than the overall observation period; and - evaluating the function using the particular transaction load as a parameter, thereby yielding a reference value for the performance metric during the current observation period.