In this lesson, you will learn how to partition continuous event streams into manageable time-based chunks using tumbling, sliding, and session windowing strategies.
Since data streams are infinite, we cannot process them as a single monolithic block. Instead, we use windowing to define temporal boundaries for aggregation. Choosing the right strategy depends on the specific analytical insight you need to extract.
Tumbling Windows
Tumbling windows are fixed-size, non-overlapping segments. If you define a 5-minute tumbling window, an event belongs to exactly one window. This is perfect for periodic reporting, such as calculating the total number of website hits every 5 minutes.
-- Conceptual Tumbling Window
SELECT count(*) FROM clicks
GROUP BY TUMBLE(event_time, INTERVAL '5' MINUTES)
Sliding Windows
Sliding windows are also fixed-size, but they can overlap. They move forward by a specific "slide" interval. If you have a 10-minute window that slides every 1 minute, you are essentially recalculating a moving average. This is ideal for detecting trends or anomalies, such as monitoring the average CPU usage over the last 10 minutes, updated every minute. Because windows overlap, a single event may be counted in multiple windows.
Session Windows
Unlike the fixed structures above, session windows are dynamic. They group events based on periods of activity separated by gaps of inactivity. A session window remains open as long as events continue to arrive within a defined timeout (e.g., 30 minutes). Once the gap between events exceeds that timeout, the window closes. This is the gold standard for tracking user behavior, such as grouping all clicks a user makes during a single browsing session before they go idle.
Why It Matters
When applying these strategies, remember that your choice of Event Time (when the event occurred) versus Processing Time (when the system observed it) will dictate the reliability of your windows. If your data arrives out of order, event-time windowing combined with watermarks ensures your calculations remain accurate despite network delays.
Key Takeaway: Tumbling windows segment data into discrete blocks, sliding windows provide continuous updates through overlap, and session windows adapt to the natural rhythm of user activity.