1. A method of processing network events, comprising: receiving multiple sets of network events, each set corresponding to a respective predefined time period and each network event having an associated group of event attributes; identifying a subset within each set of network events whose event attributes satisfy a predefined query; aggregating information concerning the identified subset of network events within each set in accordance with at least one of the event attributes; and merging the aggregated information associated with the multiple sets of network events so as to produce a merged set of results for the predefined query.