https://community.splunk.com/t5/Splunk-Search/metadata-with-powershell-Search-Splunk-command/m-p/380465#M111346 <P>I am trying to run the following search, which works fine from the regular Splunk search UI, but not in the Powershell interface...</P> <P><STRONG><EM>| metadata type=hosts earliest=-1d</EM></STRONG></P> <P>Using the Search_Splunk command I get...</P> <P><STRONG><EM>Error in 'metadata' command: This command must be the first command of a search</EM></STRONG></P> <P>If I remove the <STRONG><EM>|</EM></STRONG> the script completes without error but no data is returned, unlike in the UI where I get 600+ records.</P> <P>Any clue as to what I am doing wrong? Greatly appreciate any assistance you can provide.</P> <P>Thanks, Dan</P> Thu, 08 Nov 2018 20:24:37 GMT dchallis2017 2018-11-08T20:24:37Z https://community.splunk.com/t5/Splunk-Search/metadata-with-powershell-Search-Splunk-command/m-p/380465#M111346 <P>I am trying to run the following search, which works fine from the regular Splunk search UI, but not in the Powershell interface...</P> <P><STRONG><EM>| metadata type=hosts earliest=-1d</EM></STRONG></P> <P>Using the Search_Splunk command I get...</P> <P><STRONG><EM>Error in 'metadata' command: This command must be the first command of a search</EM></STRONG></P> <P>If I remove the <STRONG><EM>|</EM></STRONG> the script completes without error but no data is returned, unlike in the UI where I get 600+ records.</P> <P>Any clue as to what I am doing wrong? Greatly appreciate any assistance you can provide.</P> <P>Thanks, Dan</P> Thu, 08 Nov 2018 20:24:37 GMT https://community.splunk.com/t5/Splunk-Search/metadata-with-powershell-Search-Splunk-command/m-p/380465#M111346 dchallis2017 2018-11-08T20:24:37Z