This server enables AI agents to conduct structured, multi-iteration Splunk investigations entirely on-device, using deterministic detectors and iterative reporting.
Start an investigation (splunk__investigate_start): Load a local Splunk export (JSON/CSV) or run a live SPL query; triggers detectors (spike detection, cert anomalies, slow queries, numeric anomalies, host rankings, etc.) and returns structured findings with a run_id.
Submit reports and follow-up queries (splunk__submit_report): Submit a markdown report (with confidence level) and optional follow-up SPL queries; the server executes queries, generates new findings, and signals whether to continue iterating or conclude.
Retrieve current findings mid-loop (splunk__get_findings): Inspect the latest detector output for an active investigation without advancing the loop.
Pause an investigation (splunk__pause): Gracefully stop the investigation loop after the current iteration completes.
Inject analyst hints (splunk__hint): Provide a hint (e.g., "focus on web-01 after 14:30 UTC") to guide the next reasoning iteration.
Retrieve example SPL queries (splunk__query_examples): Pull historical SPL queries from past investigations (optionally filtered by area such as "tls" or "auth") to ground new queries in proven field names and patterns.
Trace code call chains via LSP (splunk__lsp_call_chain): Given a function or symbol, trace callers/callees through microservice source code to identify which code path produced a specific log error — bridging findings directly to source code (requires a repo path at investigation start).
Provides tools for investigating Splunk data by ingesting exports (JSON/CSV) or running live SPL queries, applying deterministic detectors, and managing an investigation loop with findings and reports.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@Splunk Intelligence MCP Server Investigate cert_errors.json for anomalies"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
A local Splunk investigation stack that ingests exports (JSON/CSV) or runs live SPL queries, applies deterministic detectors, and drives a structured multi-iteration investigation loop via MCP tools exposed to AI agents (GitHub Copilot or Claude Code). Everything runs on-device — no data leaves the machine.
Splunk export (JSON/CSV) ──or── Splunk REST API
└─> parsers.py # Polars DataFrame: field extraction, timestamp normalisation
└─> detectors.py # rule-based: spikes, patterns, cert anomalies, correlations,
│ # severity, host rankings, slow queries, numeric anomalies
└─> connector.py # facade: loading, detection, run state — no HTTP, no server
│ # process; MCP tools, the TUI, runner.py, and its own CLI
│ # all call into it directly
└─> mcp_server.py # FastMCP: exposes investigation tools to Copilot / Claude
└─> tui.py # terminal UI: run history + live progress, reads splunk.db directly
└─> runner.py # CLI orchestrator
└─> reports/ # generated markdown reports
└─> logs/ # per-run JSONL structured logs (audit trail — every
│ # investigate/pause/hint/done action, not just the CLI pipeline)
└─> splunk.db # SQLite: events, findings, reports, queries, active_runs, alerts per run_id
standalone/ # top-level dir: processes that run outside the MCP/agent loop
└─> agent.py # optional: standalone LangGraph ReAct loop (--investigate flag),
│ # via splunk/llm_backends.py — ollama / claude_cli / copilot_cli
└─> watcher.py # standalone process (python -m standalone.watcher) — polls Splunk on an
# interval, runs detectors, writes hits to splunk.db's alerts table;
# consumed via splunk__check_alerts / splunk__ack_alertThe investigation loop is self-contained — splunk__submit_report returns {status, findings, next} and the agent loops on its own without external hooks.
Copilot/Claude via MCP is the primary reasoning path — no Ollama or CLI subprocess required. For environments without either, standalone/agent.py provides an optional standalone LangGraph ReAct agent, enabled via uv run python -m splunk --input <file> --investigate (requires uv sync --extra llm). See Standalone agent below for backend options.
Related MCP server: Splunk MCP for SOC Operations
Python 3.12+
uv — brew install uv
Splunk instance URL (set SPLUNK_URL env var; required for live queries only)
uv sync --extra dev
uv run playwright install chromiumecho "SPLUNK_URL=https://your-splunk-instance:8089" > .envuv run python -m splunk.authThis opens a visible Chromium window via Playwright. Complete the SSO login manually. The session cookie is saved to ~/.splunk/auth.json and loaded automatically on every live query. Re-run when your session expires (Splunk uses SSO/SAML — password login is not available).
# From a local export file
uv run python -m splunk --input results/cert_errors.json
# Live SPL query
uv run python -m splunk --live --spl "index=pki sourcetype=ocsp_error" --earliest -6hNo server process required — start the MCP tool server, and optionally the TUI:
# Terminal 1 — MCP tool server
uv run python -m splunk.mcp_server
# Terminal 2 (optional) — terminal UI for watching live investigation progress
uv run python -m splunk.tuiThen ask Copilot or Claude: "Start a Splunk investigation on results/cert_errors.json"
The agent calls splunk__investigate_start, reasons over findings, and loops via splunk__submit_report until confident. See AGENTS.md for the full loop protocol.
The TUI reads splunk.db directly for run history and the rendered report, and polls the active_runs table for live iteration/confidence/event-count every ~2s — no HTTP involved. Because every connector function writes to active_runs regardless of which process calls it, the TUI shows live per-iteration progress for both MCP/Claude-driven investigations and the standalone --investigate agent path — previously (before this design), MCP-driven progress was invisible to any other process since it only lived in an in-memory dict inside whichever process was running it.
Same investigation engine, no MCP tool-calling required:
uv run python -m splunk.connector start --source results/cert_errors.json
uv run python -m splunk.connector submit-report --run-id <id> --report "..." --queries "-- area\nindex=pki ..."
uv run python -m splunk.connector get-findings --run-id <id>
uv run python -m splunk.connector pause --run-id <id>
uv run python -m splunk.connector hint --run-id <id> --text "focus on web-01 after 14:30 UTC"--investigate)For environments without Copilot or Claude Code driving MCP tools directly, standalone/agent.py
runs its own LangGraph ReAct loop over the same detector findings and produces the same kind of
markdown report. It's a fallback, not the primary path — prefer the MCP flow above when available.
uv sync --extra llm # pulls in langgraph, langchain-core, langchain-ollama
uv run python -m splunk --input results/cert_errors.json --investigateThe chat backend driving the loop is selected via SPLUNK_AGENT_BACKEND (default ollama):
Backend | Requires | Notes |
|
| Model via |
|
| No API key needed — reuses your existing login. Model via |
|
| No API key needed. Model via |
# Ollama (default) — needs `ollama serve` running and the model pulled
ollama pull qwen2.5:14b
uv run python -m splunk --input results/cert_errors.json --investigate
# Claude CLI — no separate server process, reuses your `claude` login
SPLUNK_AGENT_BACKEND=claude_cli \
uv run python -m splunk --input results/cert_errors.json --investigate
# Copilot CLI
SPLUNK_AGENT_BACKEND=copilot_cli \
uv run python -m splunk --input results/cert_errors.json --investigateclaude_cli/copilot_cli shell out to the CLI non-interactively (claude -p / copilot -p)
with the CLI's own tool use disabled, bridging tool-calling by hand via a small JSON protocol —
see splunk/llm_backends.py and splunk/cli_tool_protocol.py for how. One CLI session is opened
per investigation and reused (--resume) across all ReAct iterations rather than starting cold
every turn.
SPLUNK_AGENT_MAX_ITER (default 10) caps ReAct loop iterations regardless of backend.
/splunk-investigate <input> — the investigation loop (splunk__investigate_start →
reason over findings → splunk__submit_report → repeat). <input> is a file path or an
SPL query — one skill handles both:
/splunk-investigate results/cert_errors.json or
/splunk-investigate "index=pki sourcetype=ocsp_error" --earliest -6h
If invoked with no argument, it asks.
Tool | Purpose |
| Load file or live SPL query, run detectors, return structured findings + |
| Submit a markdown report and follow-up SPL queries; returns |
| Read current findings for an active run without advancing the loop |
| Stop the loop after the current iteration |
| Inject an analyst hint that shapes the next iteration |
| Return past SPL queries from |
| Trace a function/symbol through a microservice's call graph to find which code path produced a log error (requires |
| Read unacknowledged alerts written by the standalone watcher ( |
| Mark a watcher alert as acknowledged so it stops appearing in |
An interactive onboarding prompt is available for GitHub Copilot. In VS Code Copilot Chat, attach .github/prompts/onboard.prompt.md via the # file picker — Copilot will walk you through setup, auth, and running your first investigation.
uv run pytest tests/Tests are fully deterministic — no Splunk connection, no server required. Fixtures live in tests/fixtures/.
--live path locallylocal_splunk/ provides a throwaway single-instance Splunk container (Docker, based on
splunk/docker-splunk) for exercising --live
queries against a real Splunk REST API and real SPL execution — without production credentials
or SSO. See local_splunk/README.md for setup/teardown steps.
File | Purpose |
| All tunables — thresholds, paths, auth |
|
|
|
|
| Facade: loading, run state, standalone agent loop, |
| FastMCP server — 9 investigation tools (thin wrappers over connector.py) |
| Terminal UI — |
| CLI entry point |
| Splunk REST client (cookie-based, SSO-compatible) |
| Playwright SSO — opens Chromium, saves cookie |
| SQLite store: events, findings, reports, queries, active_runs, alerts, per-sourcetype schema cache |
| Structured JSON-lines logging per run — audit trail for every connector action |
| Standalone |
| Standalone LangGraph ReAct agent ( |
| Pluggable chat backend for |
| Registry of investigation domains (prompt + SPL template) consumed by |
Variable | Default | Purpose |
| — | Splunk base URL (required for live queries) |
|
| Default index substituted into generated follow-up SPL (standalone agent path) |
| — | Comma-separated indexes relevant to your environment — reference only, surfaced to the user during the live-SPL preflight; doesn't affect |
|
| MCP-driven investigation loop's iteration cap (primary path — |
|
| Event-pair correlation window (seconds) for |
|
| Events/window to trigger a spike |
|
| Spike detection window (seconds) |
|
| Duration (ms) above which an event is flagged as a slow query |
|
| Rolling window size (events) for z-score anomaly detection |
|
| |z-score| above which an event is flagged as a numeric anomaly |
|
| Splunk session cookie name |
|
| Cookie persist path |
|
| Live REST job polling interval (seconds) |
|
| Live REST job poll timeout (seconds) |
|
| Max silent re-auth attempts on a 401 before failing |
|
| Log verbosity |
|
| Standalone agent ( |
|
| Ollama model (backend |
|
| Model passed to |
|
| Model passed to |
|
| Standalone agent ReAct loop cap |
| — | SPL query the watcher ( |
|
| Seconds between watcher poll cycles |
Put these in a .env file at the repo root (gitignored).
GitHub Copilot — see AGENTS.md for loop rules, MCP tool reference, and report format
Claude Code — see CLAUDE.md for project conventions and task backlog
Onboarding — see .github/prompts/onboard.prompt.md
Unclaimed servers have limited discoverability.
If you are the server author, to access and configure the admin panel.
CVE lookups (NVD) and dependency-manifest audits (OSV) for AI agents. No API keys.
CVE lookups (NVD) and dependency-manifest audits (OSV) for AI agents. No API keys.
AI agent run monitoring with incident replay and SLA receipts.
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/debaditya-mohankudo/splunk-intelligence'
If you have feedback or need assistance with the MCP directory API, please join our Discord server