26. The computer program product stored in a non-transitory computer-readable storage medium of claim 25 , wherein the aggregation instructions further include: instructions for assigning a session identifier to a network event in a particular identified subset; instructions for identifying an aggregation entry in a particular aggregation result table, associated with the particular identified subset, in accordance with the network event's value for the at least one of the event attributes, the aggregation entry including a set of session identifiers; instructions for inserting the network event's session identifier into the set of session identifiers if the network event's session identifier is not included in the set of session identifiers; and instructions for changing a position of the aggregation entry in the particular aggregation result table if a predefined condition is met.
25. A computer program product stored in a non-transitory computer-readable storage medium, for use in conjunction with a computer system, comprising: receiving instructions for receiving multiple sets of network events, each set corresponding to a different respective predefined time period and each network event having an associated group of event attributes; an event filter for identifying a subset, within each set of network events, whose event attributes satisfy a predefined query; and generation instructions for generating a distinct aggregation result table for each identified subset of network events; aggregation instructions for: aggregating, in a first aggregation result table, information concerning a first identified subset of network events in accordance with at least one of the event attributes; and aggregating, in a second aggregation result table, information concerning a second identified subset of network events in accordance with the at least one of the event attributes; and query result instructions for merging the first and second aggregation result tables aggregated information associated with the multiple sets of network events so as to produce a merged set of results for the predefined query; wherein the query result instructions further comprise instructions for: identifying a first entry in the first aggregation result table and a second entry in the second aggregation result table, wherein the first entry and the second entry have the same value for the at least one of the event attributes; and generating a new entry in a query result table by combining the first and second entries together.