Techniques and mechanisms for automatically identifying counters/features of a network component that are related to a state change (or event) for the network component or for the network itself. For example, using data obtained from the network component around a time of the state change, delta averages for the features around the time of the state change may be determined. The delta averages may be utilized to determine which counters/features are most descriptive for a particular state change. The counter/features that are the most descriptive for a particular state change is as important as the change detection itself. This is especially true since in a case of an event/state change occurring, a large amount of counters/features may react to the state change or event. Thus, the techniques described herein provide for an approach to distill which counters/features contribute the most to a particular state change from a data driven perspective.