Getting Data In

Why does "splunk train cmd classify" say "Parameters must be in the form '-parameter value'

mpatnode
Path Finder

I tried "splunk train sourcetype filename sourcename" and received the same error. Then I found this answer and got the following:

$ /opt/splunk/bin/splunk train cmd classify /home/mike/work/current/tests/last_2k3.log centrifydc Parameters must be in the form '-parameter value'

So back to the original question, do you pass the train command a sample log file, or something else?

Tags (2)
1 Solution

rroberts
Splunk Employee
Splunk Employee

Remove the word train in your command. Classify replaces train.

View solution in original post

rroberts
Splunk Employee
Splunk Employee

Remove the word train in your command. Classify replaces train.

mpatnode
Path Finder

Doh! Awsome. Thanks.

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...