Splunk Search

| metadata with powershell Search-Splunk command

dchallis2017
New Member

I am trying to run the following search, which works fine from the regular Splunk search UI, but not in the Powershell interface...

| metadata type=hosts earliest=-1d

Using the Search_Splunk command I get...

Error in 'metadata' command: This command must be the first command of a search

If I remove the | the script completes without error but no data is returned, unlike in the UI where I get 600+ records.

Any clue as to what I am doing wrong? Greatly appreciate any assistance you can provide.

Thanks, Dan

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...