25. A computer program product stored in a non-transitory computer-readable storage medium, for use in conjunction with a computer system, comprising: receiving instructions for receiving multiple sets of network events, each set corresponding to a different respective predefined time period and each network event having an associated group of event attributes; an event filter for identifying a subset, within each set of network events, whose event attributes satisfy a predefined query; and generation instructions for generating a distinct aggregation result table for each identified subset of network events; aggregation instructions for: aggregating, in a first aggregation result table, information concerning a first identified subset of network events in accordance with at least one of the event attributes; and aggregating, in a second aggregation result table, information concerning a second identified subset of network events in accordance with the at least one of the event attributes; and query result instructions for merging the first and second aggregation result tables aggregated information associated with the multiple sets of network events so as to produce a merged set of results for the predefined query; wherein the query result instructions further comprise instructions for: identifying a first entry in the first aggregation result table and a second entry in the second aggregation result table, wherein the first entry and the second entry have the same value for the at least one of the event attributes; and generating a new entry in a query result table by combining the first and second entries together.
25. A computer program product stored in a non-transitory computer-readable storage medium, for use in conjunction with a computer system, comprising: receiving instructions for receiving multiple sets of network events, each set corresponding to a different respective predefined time period and each network event having an associated group of event attributes; an event filter for identifying a subset, within each set of network events, whose event attributes satisfy a predefined query; and generation instructions for generating a distinct aggregation result table for each identified subset of network events; aggregation instructions for: aggregating, in a first aggregation result table, information concerning a first identified subset of network events in accordance with at least one of the event attributes; and aggregating, in a second aggregation result table, information concerning a second identified subset of network events in accordance with the at least one of the event attributes; and query result instructions for merging the first and second aggregation result tables aggregated information associated with the multiple sets of network events so as to produce a merged set of results for the predefined query; wherein the query result instructions further comprise instructions for: identifying a first entry in the first aggregation result table and a second entry in the second aggregation result table, wherein the first entry and the second entry have the same value for the at least one of the event attributes; and generating a new entry in a query result table by combining the first and second entries together. 32. The computer program product stored in a non-transitory computer-readable storage medium of claim 25 , wherein the query result instructions include analysis engine includes instructions for associating a session count with each entry in the query result table, and the query result instructions includes instructions for combining session counts of matching entries in two or more of the aggregation result tables.