Why does "splunk train cmd classify" say "Parameters must be in the form '-parameter value'

[mpatnode]

I tried "splunk train sourcetype filename sourcename" and received the same error. Then I found this answer and got the following:

$ /opt/splunk/bin/splunk train cmd classify /home/mike/work/current/tests/last_2k3.log centrifydc Parameters must be in the form '-parameter value'

So back to the original question, do you pass the train command a sample log file, or something else?

[rroberts · Accepted solution]

Remove the word train in your command. Classify replaces train.

[mpatnode]

Doh! Awsome. Thanks.