I started with the all-time case since that felt simpler: just a hashmap from target ID to count, then a min-heap of size K to get the top results.
Start by clarifying requirements: event rate, latency, consistency, and query patterns. Then propose a scalable architecture using a distributed stream processor and a time-series database, with a two-level index for efficient top-K queries. Discuss trade-offs between exact and approximate counting, and how to handle time-range filters.
Pro tip: Emphasize that top-K queries over sliding windows are best served by a combination of a time-partitioned store and a heap-based aggregation, and mention that approximate algorithms like Count-Min Sketch can reduce memory at the cost of accuracy—showing you understand real-world trade-offs.
Ask about event volume, query frequency, latency SLAs, and whether approximate results are acceptable. Determine if the system needs to handle out-of-order events and how far back queries typically go.
Propose a pipeline: ingest via a message queue (e.g., Kafka), process with a stream processor (e.g., Flink) that maintains counts per target, and store aggregated data in a time-series database (e.g., Druid, TimescaleDB) for fast range queries.
For each time window, maintain a min-heap of size K to track top targets, or use a Count-Min Sketch for approximate counts. Discuss how to merge results across windows for arbitrary time ranges.
For a time-range query, retrieve pre-aggregated counts from the time-series store, then compute top-K using a heap or by sorting. Consider caching frequent queries and using indexes on target ID and timestamp.
Discuss trade-offs: exact vs. approximate counting, memory vs. accuracy, latency vs. consistency. Explain how to scale horizontally by partitioning by target ID or time, and how to handle hot targets.
AI-generated suggestions, not part of the candidate's original notes. May be inaccurate — verify before relying on them.