Facilities wants a congestion indicator for the main atrium that updates every two minutes but reflects the average visitor-flow rate over the trailing ten minutes, so a short burst at the entrance doesn't cause the indicator to spike and immediately drop back down. Which windowing function delivers this trailing, overlapping average?

A hopping window keeps a fixed window duration but advances by a hop interval smaller than that duration, so consecutive windows overlap and share most of the same underlying events. A ten-minute duration with a two-minute hop recomputes the atrium's average visitor-flow rate every two minutes using the trailing ten minutes of data, which smooths a short entrance burst across several overlapping windows instead of letting it dominate a single narrow calculation.

A tumbling window with a ten-minute duration would only refresh once every ten minutes with no overlap, which is both less frequent than the required two-minute cadence and more susceptible to a burst dominating a single, non-overlapping segment. A snapshot window groups only events sharing an identical timestamp, an unrelated concept with no averaging span at all. A session window closes on a gap of inactivity rather than a fixed refresh cadence, and a busy atrium with continuous foot traffic would rarely, if ever, produce the kind of gap a session window needs to close and emit a result.

A caveat: because hopping windows overlap, any given visitor-flow event can be counted in multiple windows (here, up to five, since ten minutes divided by a two-minute hop is five), so this pattern is appropriate for an average or rate but would badly overstate a running total. Operationally, confirm the smoothing is working by comparing the hopping-window series against a raw one-minute count series and checking that short spikes are visibly dampened rather than passed through unchanged.