Abstract: Methods, systems, and apparatus, including computer programs encoded on computer storage media, for identifying and characterizing signals contained in a data stream. One of the methods includes: obtaining an historical time distribution of event counts associated with a topic for a relevant time period; extracting a predictable portion of the historical time distribution of event counts to produce a residual event count time distribution including residual event counts at successive times; determining a residual triggering threshold based on the residual event count time distribution; and taking an action when a residual event count exceeds the residual triggering threshold. The action can include providing a notification to a user of a spike in event counts associated with the topic.