Custom search text box

[prad18]

Hi,

I've created custom text box to search the events in splunk.
my xml :

< module name="HiddenSearch" layoutPanel="panel_row3_col1" group="Search field" autoRun="false">
    < param name="search">host=myhost Fieldname=  *$target$*  < /param>

< module name="ExtendedFieldSearch">

    < param name="intention">
          < param name="name">stringreplace < /param>
     < param name="arg">  
         < param name="target">
           < param name="default">500 < /param>
         < /param>
     < /param>

    < /param>

   < param name="replacementMap">

     < param name="arg">
       < param name="target">
         < param name="value"> < /param>
       < /param>
     < /param>

   < /param>

  < param name="field">Test< /param>

< module name="ResultsHeader" layoutPanel="panel_row3_col1" group="splIcon-events-list" altTitle="Events List">
        < param name="entityLabel">events < /param>
        < param name="entityLabelSingular">event < /param> 
        < param name="entityName">events < /param>

     < module name="Export" layoutPanel="panel_row3_col1">
        < param name="exportType">event < /param> 
     < /module> 

     < module name="EnablePreview" group="show" layoutPanel="panel_row3_col1">
        < param name="enable">True < /param>
     < /module>

     < module name="Paginator" layoutPanel="panel_row3_col1">
        < param name="entityName">events < /param>
        < param name="maxPages">10 < /param>

          < module name="EventsViewer"> 
            < param name="displayRowNumbers">True < /param>
            < param name="enableBehavior">True < /param > 
          < /module>
     < /module>

< /module>

  < /module>

< /module> 

In UI, it has created a text box with label Test in which user will enter input text to serach.

1. Initially my query was just host=myhost *$target$* target will have user entered input which will be searched in events and it was working fine and even highlighting the input(which user entered in textbox) in the search result. But when i changed the query from host=myhost *$target$* to host=myhost fieldname = *$target$* it worked but stopped highlighting in search results? How to enable highlighting?

2. How to validate whether user entered any input or just left text box empty? because right now it is searching even if textbox is empty?

I'm new to splunking. Please help me to resolve these and is there any blog or document to understand the xml used in splunk from scratch, I mean each and every < module > used in xml.

[linu1988]

Is it a module? Try defining in there

[martin_mueller]

Concerning highlighting, take a look at the highlight command: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/highlight

[prad18]

Thank you martin.

How can we do validation here?
One more thing is this xml a right one to create search text box ? or should i do it using