In UI, it has created a text box with label Test in which user will enter input text to serach.
Initially my query was just host=myhost *$target$* target will have user entered input which will be searched in events and it was working fine and even highlighting the input(which user entered in textbox) in the search result. But when i changed the query from host=myhost *$target$* to host=myhost fieldname = *$target$* it worked but stopped highlighting in search results? How to enable highlighting?
How to validate whether user entered any input or just left text box empty? because right now it is searching even if textbox is empty?
I'm new to splunking. Please help me to resolve these and is there any blog or document to understand the xml used in splunk from scratch, I mean each and every < module > used in xml.