1. A method, comprising: obtaining machine-generated time-series performance data collected during execution of a software program in a computer system; analyzing the machine-generated time-series performance data by performing the following operations by a processor: removing a subset of the machine-generated time-series performance data within an interval around one or more known anomalous events of the software program to generate filtered time-series performance data; using the filtered time-series performance data to build a statistical model of normal behavior in the software program; obtaining a number of unique patterns learned by the statistical model; when the number of unique patterns satisfies a complexity threshold, but not when the number of unique patterns fails to satisfy the complexity threshold: applying the statistical model to subsequent machine-generated time-series performance data from the software program to identify an anomaly in an activity of the software program; and storing an indication of the anomaly for the software program based at least in part on identifying the anomaly in the activity of the software program.