1. A computing system comprising: a network interface that is coupled to a data network for receiving and transmitting one or more packet flows; a processor; and one or more stored program instructions configured for execution by the processor in order to cause the computing system to: create and store in computer memory a first filter chain indicating one or more first membership criteria; apply the first filter chain to a data set to identify: one or more first data items that satisfy the first membership criteria; one or more second data items that do not satisfy the first membership criteria; transmit the first data items and the second data items to a client computer configured to display the first data items in a first filter view in a first graphically demarcated area and the second data items in a second filter view in a second graphically demarcated area; receive a user selection of the first graphically demarcated area and the second graphically demarcated area; determine one or more second membership criteria; create a second filter chain based on the first filter chain and the second membership criteria; apply the second filter chain to the data set to identify: one or more third data items that satisfy the first membership criteria and the second membership criteria; one or more fourth data items that satisfy the first membership criteria and do not satisfy the second membership criteria one or more fifth data items that satisfy the second membership criteria and do not satisfy the first membership criteria, and one or more sixth data items that do not satisfy the first membership criteria and do not satisfy the second membership criteria; transmit the third data items, the fourth data items, the fifth data items, and sixth data items to the client computer, wherein the client computer is configured to display the third data items and the fourth data items in the first graphically demarcated area, and the fifth data items and the sixth data items in the second graphically demarcated area.