An embodiment may involve a managed network containing computing devices. The computing devices may be respectively associated with unqualified domain names. One or more server devices may be disposed within a remote network management platform that manages the managed network. These server devices may be configured to: probe the managed network, by way of a proxy server application disposed within the managed network, to obtain information related to applications operating on the computing devices, network connectivity of the computing devices, and representations of the unqualified domain names; obtain a regular expression; determine a subset of the computing devices in the managed network on which a particular application is operating and for which the respectively associated unqualified domain names match the regular expression; and generate a map of the managed network in which the subset of the computing devices is represented as a grouped node instead of individual nodes.