Dynamic field name extration

[ninisimonishvil]

Here is the data :

"app": "https", "purpose": "bypass", "direction": "outbound", "int64gapps": "0" }, { "app": "https", "purpose": "inspect", "direction": "outbound", "int64gapps": "0" }, { "app": "http", "purpose": "bypass", "direction": "outbound", "int64gapps": "0" }, { "app": "http", "purpose": "inspect", "direction": "outbound", "int64gapps": "0"

And here is regex: \"app":\s\"(\w*)",\s"purpose":\s\"(\w*)",\s"direction":\s"\w*",\s"int64gapps":\s"(\d*)"

I have 3 groups and as a Format I want it to use Group 1 and 2 as a Field name and group 3 as a value. so my FORMAT= $1.$2::$3

TRANSFORMS.conf
[Bandtest]
REGEX=(\"app":\s\"(\w*)",\s"purpose":\s\"(\w*)",\s"direction":\s"\w*",\s"int64gapps":\s"(\d*)")
FORMAT=$1.$2::$3
WRITE_META = True

PROPS.cong
[radware_api_stat]
TRANSFORMS-Bandtest = Bandtest

I need SPlunk to extract field names httpbypass and httpinspect, it only extracts the first one. in short I need it to get multiple field names per event using the same regex, is this function available?

[FrankVl]

Is it just me, or are you processing multiple events as 1 and using field values as field names?

Does this have to be extracted at index time?

Perhaps simpler to just extract the actual fields and their values and then create some calculated fields off of those to club things together as you are describing here? But still a bit confused about the context to be honest...

[ninisimonishvil]

now I have changed it to REPORT but another issue
I have two groups and in Format I want to concatenate values FORMAT=handrej_Client_outbound::$1.$2 where first grouping is a sentence and second number.

is there any special syntax for that?