Various techniques associated with application performance monitoring are disclosed. In some embodiments, a subset of application methods is configured to capture response time metrics, and response time metrics for a prescribed application transaction are computed by summing corresponding response time metrics of methods of the subset that are executed during each transaction invocation. Method and transaction response time metrics are collected for each of a plurality of observation intervals, and the collected response time metrics are analyzed to identify anomalous method and transaction states. Co-occurring anomalous transaction and method states are correlated to identify a set of hotspot methods for the transaction, wherein hotspot methods comprise expected root causes for anomalies of the transaction.