I see you asked this in Slack, but you can use foreach on your final data example, there could be a better way to work it out in the foreach. Not sure what you want to do about the host name prefix, ...
See more...
I see you asked this in Slack, but you can use foreach on your final data example, there could be a better way to work it out in the foreach. Not sure what you want to do about the host name prefix, but if it's fixed you can add it back | makeresults format=csv data="host_list
abc0002
abc0003
abc0004
abc0005
abc0006
abc0007
abc0008
abc0009
abc0010
abc0011
abc0012
abc0013
abc0014
abc0015
abc0016
abc0017
abc0018
abc0019
abc0020
abc0022
abc0024
abc0025
abc0026
abc0027
abc0028
abc0029
abc0031"
| eval test="new"
| stats values(host_list) as host_list by test
``` Above is creating your example data ```
``` Get the numeric part ```
| rex field=host_list max_match=0 "(?<prefix>[^0-9]*)(?<id>\d+)"
| eval c=0
| foreach id mode=multivalue [ eval n=<<ITEM>>, diff=n-prev, ss=case(isnull(ss), mvindex(prefix, c).<<ITEM>>, diff>1, mvappend(ss, mvindex(prefix, c).<<ITEM>>), true(), ss), ee=case(isnull(ss), null(), diff>1, mvappend(ee, r), true(), ee), r=mvindex(prefix, c).<<ITEM>>, prev=n, c=c+1 ]
| eval ee=mvappend(ee, r)
| eval ranges=mvzip(ss, ee, "-")
| fields - diff id n prev r ss ee c