-- fraud processing on a stream of auths from a point of sale
SELECT card,
MAX(amount) as max_amount,
TUMBLE_END(eventTimestamp, interval '5' minute) as ts,
lat,
lon
FROM auth
GROUP BY card, TUMBLE(eventTimestamp, interval '5' minute)
HAVING COUNT(*) > 4