Based on your Slack response, I think this is what you will want ...your search ...
| rex field=host_list max_match=0 "(?<prefix>[^0-9]*)(?<id>\d+)"
| eval prefix=mvdedup(prefix)
| foreach id mode=m...
See more...
Based on your Slack response, I think this is what you will want ...your search ...
| rex field=host_list max_match=0 "(?<prefix>[^0-9]*)(?<id>\d+)"
| eval prefix=mvdedup(prefix)
| foreach id mode=multivalue [ eval n=<<ITEM>>, diff=n-prev, ss=case(isnull(ss), n, diff>1, mvappend(ss, n), true(), ss), ee=case(isnull(ss), null(), diff>1, if(r=mvindex(ss,-2), mvappend(ee, " "), mvappend(ee, r)), true(), ee), r=n, prev=n ]
| eval ee=if(r=mvindex(ss,-1), mvappend(ee, " "), mvappend(ee, r))
| eval ranges=prefix."[".mvjoin(rtrim(mvzip(ss, ee, "-"), "- "), ",")."]"
| fields - diff id n prev r ss ee