12. A method comprising: monitoring entity instances during a first interval, each entity instance being one of a plurality of types of entity instances; determining from the entity instances monitored during the first interval a first ranked list of entity instances in which the types of entity instances are ranked according to the number of times each type of entity instance occurred during the first interval, the first ranked list having a first cardinality of types of entity instances; monitoring entity instances during a second interval, each entity instance being one of the plurality of types of entity instances; determining from the entity instances monitored during the second interval a second ranked list of entity instances in which the types of entity instances are ranked according to the number of times each type of entity instance occurred during the second interval, the second ranked list having the first cardinality of types of entity instances; and merging the first ranked list and the second ranked list into a third ranked list of entities instances in which the types of entity instances are ranked according to the number of times each type of entity instance occurred during the first interval and the second interval; wherein monitoring entity instances during a first interval comprises: entering monitored entity instances in a first table; determining if an entity instance in the first table has a count that is greater than a threshold count; entering the entity instance in a second table if the entity instance in the first table has a count that is greater than the threshold count; determining if the second table has the first cardinality of entries; and ending the first interval if the second table has the first cardinality of entries.
12. A method comprising: monitoring entity instances during a first interval, each entity instance being one of a plurality of types of entity instances; determining from the entity instances monitored during the first interval a first ranked list of entity instances in which the types of entity instances are ranked according to the number of times each type of entity instance occurred during the first interval, the first ranked list having a first cardinality of types of entity instances; monitoring entity instances during a second interval, each entity instance being one of the plurality of types of entity instances; determining from the entity instances monitored during the second interval a second ranked list of entity instances in which the types of entity instances are ranked according to the number of times each type of entity instance occurred during the second interval, the second ranked list having the first cardinality of types of entity instances; and merging the first ranked list and the second ranked list into a third ranked list of entities instances in which the types of entity instances are ranked according to the number of times each type of entity instance occurred during the first interval and the second interval; wherein monitoring entity instances during a first interval comprises: entering monitored entity instances in a first table; determining if an entity instance in the first table has a count that is greater than a threshold count; entering the entity instance in a second table if the entity instance in the first table has a count that is greater than the threshold count; determining if the second table has the first cardinality of entries; and ending the first interval if the second table has the first cardinality of entries. 15. The method of claim 12 , wherein the measurement interval is defined by the number of entity instance types monitored.