Skip to main content
Glama
livehybrid

splunk-mcp

by livehybrid
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python
Remote

Server Configuration

Describes the environment variables required to run the server.

NameRequiredDescriptionDefault
VERIFY_SSLNoEnable/disable SSL verificationtrue
SERVER_MODENoServer mode (sse, api, stdio)sse
SPLUNK_HOSTYesYour Splunk host address
SPLUNK_PORTNoSplunk management port8089
SPLUNK_TOKENNoSplunk authentication token (optional; if set, used instead of username/password)
SPLUNK_SCHEMENoConnection schemehttps
SPLUNK_PASSWORDNoYour Splunk password
SPLUNK_USERNAMENoYour Splunk username
FASTMCP_LOG_LEVELNoLogging levelINFO

Instructions

Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.

This server publishes no instructions, or was last inspected before Glama recorded them.

Capabilities

Server capabilities have not been inspected yet.

Tools

Functions exposed to the LLM to take actions

NameDescription
search_splunkB
Execute a Splunk search query and return the results.

Args:
    search_query: The search query to execute
    earliest_time: Start time for the search (default: 24 hours ago)
    latest_time: End time for the search (default: now)
    max_results: Maximum number of results to return (default: 100)
    
Returns:
    List of search results
list_indexesB
Get a list of all available Splunk indexes.

Returns:
    Dictionary containing list of indexes
get_index_infoB
Get metadata for a specific Splunk index.

Args:
    index_name: Name of the index to get metadata for
    
Returns:
    Dictionary containing index metadata
list_saved_searchesB
List all saved searches in Splunk

Returns:
    List of saved searches with their names, descriptions, and search queries
current_userA
Get information about the currently authenticated user.

This endpoint retrieves:
- Basic user information (username, real name, email)
- Assigned roles
- Default app settings
- User type

Returns:
    Dict[str, Any]: Dictionary containing user information
list_usersA

List all Splunk users (requires admin privileges)

list_kvstore_collectionsB
List all KV store collections across apps.

Returns:
    List of KV store collections with metadata including app, fields, and accelerated fields
health_checkA

Get basic Splunk connection information and list available apps

get_indexes_and_sourcetypesA
Get a list of all indexes and their sourcetypes.

This endpoint performs a search to gather:
- All available indexes
- All sourcetypes within each index
- Event counts for each sourcetype
- Time range information

Returns:
    Dict[str, Any]: Dictionary containing:
        - indexes: List of all accessible indexes
        - sourcetypes: Dictionary mapping indexes to their sourcetypes
        - metadata: Additional information about the search
list_toolsB
List all available MCP tools.

Returns:
    List of all available tools with their name, description, and parameters.
healthA

Get basic Splunk connection information and list available apps (same as health_check but for endpoint consistency)

pingA
Simple ping endpoint to check server availability and get basic server information.

This endpoint provides a lightweight way to:
- Verify the server is running and responsive
- Get basic server information including version and server time
- Check connectivity without making complex API calls

Returns:
    Dict[str, Any]: Dictionary containing status and basic server information

Prompts

Interactive templates invoked by user choice

NameDescription

No prompts

Resources

Contextual data attached and managed by the client

NameDescription

No resources

Deploy Server
One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

TDQS

B3.3/5.0

Scored across 12 tools

Disambiguation3/5

There is significant overlap between several tools, which could cause confusion. For example, 'health' and 'health_check' appear to be duplicates, and 'list_indexes', 'get_indexes_and_sourcetypes', and 'get_index_info' all relate to indexes with unclear boundaries. However, descriptions help differentiate some tools, such as 'search_splunk' being distinct for query execution.

Naming Consistency2/5

Naming is inconsistent with mixed conventions. Some tools use verb_noun patterns like 'list_indexes' and 'search_splunk', while others use noun-only forms like 'health' and 'ping'. There are also deviations like 'get_indexes_and_sourcetypes' using 'and' in the name, and 'list_tools' is an outlier as it's meta to the server itself.

Tool Count4/5

With 12 tools, the count is reasonable for a Splunk MCP server, covering user management, indexing, searches, and health checks. It's slightly heavy due to redundant tools like 'health' and 'health_check', but overall well-scoped for the domain without being overwhelming.

Completeness3/5

The toolset covers core Splunk operations like searching, indexing, and user management, but has notable gaps. For example, there are tools to list saved searches but no way to create, update, or delete them, and similar gaps exist for KV store collections and indexes. This could lead to dead ends for agents trying to perform full lifecycle management.

Maintenance

ActivityInactive
ResponsivenessNo issues

Resources