Splunk interview question

Sliding window algorithm to scan data in realtime