1. A method, comprising: receiving, at a network traffic analyzer, a query of network traffic flow data over a certain time period; modifying the query to produce a plurality of sub-queries, wherein each of the sub-queries are based on different segments of time within the certain time period; executing at least one of the sub-queries; and incrementally outputting results of each of said executed sub-queries as each of the sub-queries are completed.