A system (830) and method (800) for diagnosing a malfunctioning machine. A fault event is selected (806) together with sequential operating parameter data (808) from a selectively focused time interval about the fault event for evaluation of a machine (810). The selectively focused time interval may include data occurring just before, just after, or spanning the fault event. Characterizing information such as slope, rate of change, and absolute sign of the data may be derived (809) from the operating parameter data over the selectively focused time interval and used in the diagnosis. The fault event and operating parameter data may be compared to existing cases in a case database (834). A set of rules (817) or candidate anomalies (841) may be executed over the operating parameter data to further improve the accuracy of the diagnosis.