mcp-server-splunk

What it does

Connects AI agents to Splunk instances, enabling the LLM to query system logs, check fired alerts, and manage saved searches without manual dashboard navigation.

Tools

• list_splunk_saved_searches: Retrieves a list of saved searches from the Splunk instance.
• list_splunk_alerts: Lists configured alerts, with optional title filtering.
• list_splunk_fired_alerts: Finds alerts that have actually triggered within a specific timeframe.
• list_splunk_indexes: Lists available data indexes in Splunk.
• list_splunk_macros: Retrieves a list of defined Splunk macros.

Installation

Add the following to your claude_desktop_config.json:

{
  "mcpServers": {
    "splunk": {
      "command": "/path/to/mcp-server-splunk",
      "env": {
        "SPLUNK_URL": "https://your-splunk-instance:8089",
        "SPLUNK_TOKEN": "your-splunk-token"
      }
    }
  }
}

Supported hosts

Cursor, Claude Desktop.