MCP Server for Splunk

What it does

Connects Large Language Models to Splunk Enterprise and Splunk Cloud, enabling AI agents to perform complex searches, monitor system health, and manage data discovery using the Model Context Protocol.

Tools

• list_workflows: Discover available troubleshooting workflows.
• workflow_runner: Execute AI-powered troubleshooting procedures.
• workflow_builder: Create custom troubleshooting procedures.
• smart_search: Natural language to SPL conversion and execution.
• metadata_exploration: Discover indexes, sources, and sourcetypes.
• system_health: Monitor Splunk infrastructure status.
• app_management: List, enable, and disable Splunk applications.

Installation

Add the following to your claude_desktop_config.json:

{
  "mcpServers": {
    "splunk": {
      "command": "uv",
      "args": ["run", "mcp-server", "--local"],
      "env": {
        "MCP_SPLUNK_HOST": "your-splunk-host",
        "MCP_SPLUNK_USERNAME": "your-username",
        "MCP_SPLUNK_PASSWORD": "your-password"
      }
    }
  }
}

Supported hosts

• Claude Desktop
• Cursor
• Google Agent Development Kit