Tumbling, sliding, and session windows

Windows group unbounded events into finite buckets so you can aggregate.

Tumbling (fixed) windows: equal size, no overlap. Every event belongs to exactly one window. Sliding windows: fixed size, but advance by a slide smaller than size, so windows overlap. Session windows: gap-based. A session closes when no events arrive for a timeout; size varies per key.

Tumbling size=5m
  |--0-5--|--5-10--|--10-15--|

Sliding size=5m, slide=2m
  |--0-5--|
     |--2-7--|
        |--4-9--|

Session gap=10m (per user)
  user A: [e  e]....gap....[e e e]
           sess1            sess2

Tiny use cases

• Tumbling: every-minute pageview counts
• Sliding: "last 5 minutes" fraud score refreshed every 1 minute
• Session: user browsing sessions on a website

Interview tip: Draw the three shapes. Say tumbling = no overlap, sliding = overlap, session = activity gap. Mention they are usually on event time with watermarks.