field extraction: matching a similar field more than once?

[mfrost8]

I'm using Splunk 4.0.10.

I've been working on doing field extractions (transforms.conf) on a DB2 log file. I've managed to pick out most of the fields that I want, but the error code is of particular significance and I'm having a problem with that. The error code would appear as a section of text within one of the other fields, but I can't predict which fields or when. So this error code could appear in one of the following ways in an event:

1) doesn't occur in the event

2) does occur once in the event

   <some text> DIA1234C <some text>

3) occurs more than once in the event

   <some text> DIA1234C <some text>
   <some text> DIA3456W <some text>

OR

   <some text> DIA1234C <some text>
   <some text> SQL3456W <some text>

I have the following rule in transforms.conf which works fine

[db2diag-log-code]
REGEX = \b([A-Z]{3}\d{4}[A-Z]{1})\b
FORMAT = code::$1

but only grabs the first error code. what I'd like is for the user to be able to search on any of the codes ("code=SQL3456W") no matter where it occurs, but this would mean that I would have to be able to assign multiple values to the "code" field which I don't think that Splunk allows. I don't want to make separate field names like code1, code2 as I can't really be sure if there will only be 2 and I would prefer to make the user have to pick.

Is there some approach that I'm not thinking of here that would allow me to make that same field have more than one value?

Thanks

[gkanapathy · Accepted solution]

Splunk supports multi-valued fields. Simply add:

MV_ADD = true

to your transforms.conf stanza.