1. A method, comprising: receiving a search query that includes a time criterion and a second criterion for selection of events; generating result sets in response to the search query, the sets including events that match the time criterion and the second criterion; merging the result sets into a set of search results; sorting the set of search results according to time; causing display of aggregated display lines summarizing the set of search results according to time windows.