list_saved_searches
Retrieve and display all saved searches from Splunk, including their names, descriptions, and search queries for easy access and management.
Instructions
List all saved searches in Splunk
Returns:
List of saved searches with their names, descriptions, and search queries
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||
Implementation Reference
- splunk_mcp.py:426-453 (handler)The handler function for the 'list_saved_searches' MCP tool. It is registered via the @mcp.tool() decorator and implements the core logic: connects to Splunk service, iterates through all saved searches, extracts name, description, and search query for each, handles errors per search, and returns a list of dictionaries containing the details.@mcp.tool() async def list_saved_searches() -> List[Dict[str, Any]]: """ List all saved searches in Splunk Returns: List of saved searches with their names, descriptions, and search queries """ try: service = get_splunk_connection() saved_searches = [] for saved_search in service.saved_searches: try: saved_searches.append({ "name": saved_search.name, "description": saved_search.description or "", "search": saved_search.search }) except Exception as e: logger.warning(f"⚠️ Error processing saved search: {str(e)}") continue return saved_searches except Exception as e: logger.error(f"❌ Failed to list saved searches: {str(e)}") raise
- splunk_mcp.py:426-426 (registration)The @mcp.tool() decorator registers the list_saved_searches function as an MCP tool.@mcp.tool()
- splunk_mcp.py:298-332 (helper)Helper function get_splunk_connection() used by list_saved_searches to establish connection to the Splunk service using environment variables for authentication.def get_splunk_connection() -> splunklib.client.Service: """ Get a connection to the Splunk service. Supports both username/password and token-based authentication. If SPLUNK_TOKEN is set, it will be used for authentication and username/password will be ignored. Returns: splunklib.client.Service: Connected Splunk service """ try: if SPLUNK_TOKEN: logger.debug(f"🔌 Connecting to Splunk at {SPLUNK_SCHEME}://{SPLUNK_HOST}:{SPLUNK_PORT} using token authentication") service = splunklib.client.connect( host=SPLUNK_HOST, port=SPLUNK_PORT, scheme=SPLUNK_SCHEME, verify=VERIFY_SSL, token=f"Bearer {SPLUNK_TOKEN}" ) else: username = os.environ.get("SPLUNK_USERNAME", "admin") logger.debug(f"🔌 Connecting to Splunk at {SPLUNK_SCHEME}://{SPLUNK_HOST}:{SPLUNK_PORT} as {username}") service = splunklib.client.connect( host=SPLUNK_HOST, port=SPLUNK_PORT, username=username, password=SPLUNK_PASSWORD, scheme=SPLUNK_SCHEME, verify=VERIFY_SSL ) logger.debug(f"✅ Connected to Splunk successfully") return service except Exception as e: logger.error(f"❌ Failed to connect to Splunk: {str(e)}") raise