| metadata with powershell Search-Splunk command

Splunk Search

I am trying to run the following search, which works fine from the regular Splunk search UI, but not in the Powershell interface...

| metadata type=hosts earliest=-1d

Using the Search_Splunk command I get...

Error in 'metadata' command: This command must be the first command of a search

If I remove the | the script completes without error but no data is returned, unlike in the UI where I get 600+ records.

Any clue as to what I am doing wrong? Greatly appreciate any assistance you can provide.

Thanks, Dan

Get Updates on the Splunk Community!

What is the Builder Bar? The Builder Bar is more than just a place; it's a hub of creativity, collaboration, ...

This article is the continuation of the “Combine multiline logs into a single event with SOCK - a step-by-step ...

You may have seen mention of the .conf Community Zone 'round these parts and found yourself wondering what ...