Splunk interview question

merge overlapping intervals