1. A computer-implemented method, comprising: employing at least one processor configured to execute computer-executable instructions stored in memory to perform the following acts: identifying one or more unique values that comprise a time-based event stream attribute, wherein the one or more unique values are non-duplicative; determining a count of the unique values; and assigning the attribute to one of a plurality of categories based on variance in the count and one or more past counts of unique values.