Splunk

You can run a Splunk MCP server that lets you interact with Splunk data using natural language. It supports real-time SSE interactions, a REST API, and a lightweight STDIO mode for direct AI-assisted workflows, enabling you to search, inspect indexes, manage KV stores, and handle Splunk resources efficiently.

How to use

Choose your preferred interaction mode and connect with your MCP client. In SSE mode (the default), you get real-time, server-sent event communication suitable for web-based clients. You can start the server in STDIO mode for direct line-by-line communication with an assistant or in API mode to expose REST endpoints.

How to install

Prerequisites: Install Python 3.10 or higher and a modern package manager such as UV, Poetry, or Pip. You will also configure environment variables to point to your Splunk instance.

# Prerequisites
# - Python 3.10+
# - UV (for fast installs) or Poetry or Pip

# Quick Start with UV
# 1. Clone the project
git clone <repository-url>
cd splunk-mcp

# 2. Install dependencies with UV
uv sync

# 3. Run in SSE mode by default
uv run python splunk_mcp.py

# Optional: run in STDIO mode
poetry run python splunk_mcp.py stdio

# Optional: run in API mode
poetry run uvicorn splunk_mcp:app --host 0.0.0.0 --port 8000 --reload  # API mode

Alternative using Poetry for dependency management and running the server:
```bash
poetry install
poetry run python splunk_mcp.py

If you prefer Pip and a requirements file instead:

pip install -r requirements.txt
python splunk_mcp.py

Additional configuration and notes

Environment variables control how you connect to Splunk and how the MCP server behaves. The key variables include the Splunk host, port, credentials, and SSL settings. You can toggle SSL verification for development or production use and adjust logging levels for troubleshooting.

Security and operational notes

• Keep sensitive credentials out of version control. Use a template like .env.example to share the required keys without exposing secrets.
• Use VERIFY_SSL=true in production to ensure secure connections to Splunk. Disable only for testing with self-signed certificates.
• Expose only necessary ports and prefer internal networking when deploying in production.

Usage patterns and capabilities

With the MCP server running, you can perform a range of actions through your MCP client:

• Run Splunk searches using natural language and receive results.
• List and inspect Splunk indexes and their properties.
• Manage users and review current permissions.
• Create, list, and delete KV store collections to organize data.
• Use asynchronous interactions for better performance and responsive tools.

Available tools

list_tools

Lists all available MCP tools with their descriptions and parameters.

health_check

Returns a list of available Splunk apps to verify connectivity.

ping

Simple heartbeat endpoint to verify MCP server responsiveness.

current_user

Returns information about the currently authenticated user.

list_users

Returns a list of all users and their roles.

list_indexes

Returns a list of all accessible Splunk indexes.

get_index_info

Returns detailed information about a specific index.

indexes_and_sourcetypes

Provides a comprehensive list of indexes and their sourcetypes.

search_splunk

Executes a Splunk search query with optional time range and result limits.

list_saved_searches

Returns a list of saved searches in the Splunk instance.

list_kvstore_collections

Lists all KV store collections.

create_kvstore_collection

Creates a new KV store collection.

delete_kvstore_collection

Deletes an existing KV store collection.