topic Why does "splunk train cmd classify" say "Parameters must be in the form '-parameter value' in Getting Data In

Why does "splunk train cmd classify" say "Parameters must be in the form '-parameter value'

mpatnode — Wed, 21 Jul 2010 07:28:55 GMT

I tried "splunk train sourcetype filename sourcename" and received the same error. Then I found this answer and got the following:

$ /opt/splunk/bin/splunk train cmd classify /home/mike/work/current/tests/last_2k3.log centrifydc Parameters must be in the form '-parameter value'

So back to the original question, do you pass the train command a sample log file, or something else?

rroberts — Sat, 24 Jul 2010 07:34:49 GMT

Remove the word train in your command. Classify replaces train.

mpatnode — Tue, 17 Aug 2010 03:24:20 GMT

Doh! Awsome. Thanks.