Basically it spits out the same hostname multiple times:

./foreman-cli3 --server https://foreman/ --custom hosts?search=+facts.processorcount+%3D+1++or+facts.domain+%3D+domain1.com --json |uniq -c
1 [
82 "app1.domain1.com",
82 "app2.domain1.com",
56 "test1.domain2.com",
1 "test1.domain2.com"
1 ]

Doing a little further digging leads me to the conclusion that the search is returning the host name an equal number of times to the number of facts that host has registered with foreman.