field extraction from some multivalued fields seperated by comma

[christythomas]

Log event x: This is the name of the group#2 target(s) [name3]
Log event y: This is the name of the group#1 target(s) [name1,name2]

just omitted other parts of log including time-stamp.
how to extract all the names to one field "members" to produce a table group , members
not able to extract the second field, i a not good in regular expressions and couldn't find a way..
Any help will be appreciated

[martin_mueller]

Two steps: First, extract the stuff between the brackets. Second, do a repeated match on the parts separated by commas:

... | rex "\[(?<members>[^\]]+)\]" | rex field=members max_match=0 "(?<members>[^,]+)"

[Lowell]

Don't forget about the simplicity of the mighty eval command:

... | rex "\[(?<members>[^\]]+)\]" | eval members=split(members, ",")