1. A method of processing network events, comprising: receiving multiple sets of network events, each set corresponding to a different respective predefined time period and each network event having an associated group of event attributes; identifying a subset, within each set of network events, whose event attributes satisfy a predefined query; generating a distinct aggregation result table for each identified subset of network events; aggregating, in a first aggregation result table, information concerning a first identified subset of network events in accordance with at least one of the event attributes; aggregating, in a second aggregation result table, information concerning a second identified subset of network events in accordance with the at least one of the event attributes; and merging the first and second aggregation result tables so as to produce a merged set of results for the predefined query; wherein the merging further comprises: identifying a first entry in the first aggregation result table and a second entry in the second aggregation result table, wherein the first entry and the second entry have the same value for the at least one of the event attributes; generating a new entry in a query result table by combining the first and second entries together; wherein the method is performed by one or more computing devices.