Execute a synchronous blocking SPL search within an explicit time window.

Args: spl: SPL search string (e.g. 'index=_internal | stats count by sourcetype'). earliest_time: Earliest time bound (e.g. '-24h@h', '-15m', '1710000000'). latest_time: Latest time bound (e.g. 'now', '@h'). count: Maximum number of results to retrieve (capped by SPLUNK_MAX_RESULTS). offset: Offset index for pagination.

Stream search results progressively via the Splunk export endpoint.

Args: spl: SPL search string. earliest_time: Earliest time bound. latest_time: Latest time bound. count: Maximum number of events to stream.

Initiate an asynchronous search job in the background and return its Job SID immediately.

Args: spl: SPL query. earliest_time: Earliest time bound. latest_time: Latest time bound. max_count: Optional maximum count limit.

Query execution status, progress percentage, and statistics of a Search Job by SID.

Args: sid: Search Job ID.

Retrieve paginated results for a completed or running Search Job.

Args: sid: Search Job ID. offset: Offset into results. count: Number of results to fetch.

Retrieve raw events associated with a Search Job.

Args: sid: Search Job ID. offset: Offset into events. count: Number of events to fetch.

Retrieve preliminary preview results for an in-progress search job.

Args: sid: Search Job ID. count: Number of preview results to fetch.

Cancel an active authorized search job.

Args: sid: Search Job ID to cancel. confirm: Confirmation flag for cancellation.

Validate SPL structure, analyze risk, performance anti-patterns, and cost estimation.

Args: spl: SPL query to analyze. earliest_time: Optional earliest time bound.

Query recent search history and jobs dispatched by the current user.

Args: count: Maximum number of history jobs to list.

List accessible Splunk indexes with disk size, event count, and disabled status.

Args: count: Number of indexes to list. offset: Pagination offset.

Query configuration, retention policies, and storage paths for a specific index.

Args: name: Index name (e.g. 'main', '_internal', 'wineventlog').

Retrieve aggregate storage volume and event statistics across all accessible indexes.

Discover sourcetypes with event count and last seen recency.

Args: index: Optional index filter (e.g. 'main', '_internal'). count: Maximum number of sourcetypes to retrieve.

Discover event sources across indexes with event counts.

Args: index: Optional index filter. count: Maximum number of sources to list.

Discover hosts reporting data into Splunk with event counts and latest observed timestamp.

Args: index: Optional index filter. count: Maximum number of hosts to list.

Obtain statistical distribution of fields and top values for an index and sourcetype.

Args: index: Target index name. sourcetype: Optional sourcetype filter. sample_count: Number of events to sample for summary.

Evaluate data recency, latest event timestamp, and ingestion latency.

Args: index: Target index. sourcetype: Optional sourcetype.

Detect time gaps in ingested data streams where expected events are missing.

Args: index: Index to analyze. sourcetype: Optional sourcetype filter. time_span: Bucket duration for binning (e.g. '15m', '1h'). earliest_time: Earliest search window.

Retrieve representative raw event samples without full table scans.

Args: index: Target index. sourcetype: Optional sourcetype filter. count: Number of sample events (default 10, max 100).

List saved searches, scheduled reports, and alerts.

Args: app: Optional Splunk app context (e.g. 'search'). count: Number of saved searches to list. offset: Pagination offset.

Retrieve full configuration, search query, schedule, and actions of a saved search.

Args: name: Name of the saved search.

Create a new saved search or scheduled report (requires write mode).

Args: name: Unique name for the saved search. search: SPL search query. description: Description of the report/saved search. cron_schedule: Cron expression (e.g. '0 * * * *'). is_scheduled: Whether to enable automatic schedule. app: App namespace (default 'search').

Update settings or query of an existing saved search.

Args: name: Name of saved search to update. search: Optional new SPL query. description: Optional new description. cron_schedule: Optional new cron expression. is_scheduled: Enable/disable scheduled execution. disabled: Enable/disable the saved search.

Delete an existing saved search (requires write mode and human confirmation).

Args: name: Name of the saved search to delete. confirm: Confirmation flag.

Dispatch and immediately run a saved search, returning its newly generated job SID.

Args: name: Name of the saved search. trigger_actions: Whether to fire configured alert actions (e.g. email, webhook).

List configured alerts and recent fired alert records.

Args: count: Maximum number of alerts to return.

Retrieve historical fired alert events over a time window.

Args: alert_name: Optional name filter for specific alert. earliest_time: Earliest time range (default '-7d@d'). count: Maximum history events.

Acknowledge or update status of an alert finding (requires write mode).

Args: alert_id: Fired alert ID. comment: Operational acknowledgement comment.

Configure or inspect suppression windows for an alert to prevent notification storms.

Args: alert_name: Name of saved search alert. suppression_period: Time duration to suppress (e.g. '1h', '30m'). enabled: Enable or disable suppression.

List dashboards (Simple XML or Dashboard Studio) in the Splunk instance.

Args: app: Optional Splunk app filter. count: Number of dashboards to retrieve. offset: Pagination offset.

Retrieve full XML or JSON definition of a dashboard.

Args: name: Dashboard view name/id. app: Optional app namespace.

Create a new Simple XML or Dashboard Studio dashboard (requires write mode).

Args: name: Unique dashboard view ID. label: Display title of dashboard. xml_data: XML or JSON dashboard definition. app: App namespace (default 'search').

Update an existing dashboard definition (requires write mode).

Args: name: Name of dashboard to update. xml_data: Updated XML/JSON definition. label: Optional new display title. app: Optional app namespace.

Delete a dashboard (requires write mode and human confirmation).

Args: name: Name of dashboard to delete. app: Optional app namespace. confirm: Confirmation flag.

List scheduled and ad-hoc reports in the environment.

Args: app: Optional app filter. count: Maximum number of reports to retrieve.

Execute a named report and retrieve its generated results.

Args: name: Name of the report/saved search. count: Maximum results to return.

List eventtypes, classifications, and search patterns.

Args: count: Maximum number of eventtypes.

List tags assigned to fields and event classifications.

Args: count: Maximum number of tags.

List configured search macros, arguments, and definition strings.

Args: count: Maximum number of macros.

Retrieve Splunk server runtime info, version, OS, license state, and topology roles.

Retrieve Splunk system health report, status features, and subsystem warnings.

List installed Splunk apps and add-ons with versions and status.

Get metadata, configurations, and permissions for a specific Splunk app.

Args: name: App folder name (e.g. 'search', 'SplunkForwarder').

List configured user accounts, roles, realnames, and authentication types with secrets redacted.

Get details, assigned roles, and permissions of a specific user.

Args: username: Username to inspect.

List configured roles, inherited roles, and allowed search indexes.

Get granular capabilities and restrictions assigned to a specific role.

Args: role_name: Name of the role (e.g. 'admin', 'user', 'power').

List available .conf configuration files accessible through REST properties.

Read stanzas and properties from a configuration file with secrets scrubbed.

Args: conf_file: Name of conf file (e.g. 'server', 'props', 'transforms', 'inputs'). stanza: Optional specific stanza name.

List configured data inputs (TCP, UDP, monitor, scripts, HTTP Event Collector).

Args: count: Maximum number of inputs.

Get configuration and status of a specific input stanza.

Args: input_type: Input type (e.g. 'monitor', 'tcp/raw', 'http', 'script'). name: Stanza name or port.

List connected Universal and Heavy Forwarders observed in the indexing pipeline.

Args: count: Maximum number of forwarders.

Inspect transmission volume, connection drops, and status for a specific forwarder.

Args: hostname: Forwarder hostname.

Detect missing forwarders that stopped transmitting data beyond expected threshold.

Args: threshold_minutes: Minutes without data before flagging as disconnected (default 15).

Retrieve historical ingestion throughput (MB/hour) broken down by index.

Args: time_span: Bucket span (e.g. '15m', '1h'). earliest_time: Earliest search window.

Measure pipeline processing lag between event occurrence timestamp and indexing time.

Args: index: Index to evaluate. sourcetype: Optional sourcetype filter. count: Sample size of events.

Detect timestamp parsing, line-breaking, and regex extraction errors recorded in _internal.

Args: earliest_time: Search window (default '-24h@h').

Verify that expected data sources are active and currently indexing data.

Args: expected_sources: List of expected source or sourcetype strings. index: Target index. lookback: Time interval to inspect.

Composite diagnostic: evaluate overall pipeline health, queue sizes, drop rates, and bottlenecks.

Detect and aggregate failed authentication events across Splunk audit, Windows, and Linux logs.

Args: index: Optional specific index (defaults to searching _audit and default indexes). earliest_time: Earliest search window (default '-24h@h'). count: Maximum aggregated rows to return.

Detect potential brute force attacks or credential stuffing based on repeated failed logins.

Args: threshold: Minimum failed attempts to flag (default 5). time_window: Bin duration (default '15m'). earliest_time: Time range to analyze (default '-4h').

Forensic investigation of an IP address across firewall, proxy, authentication, and web logs.

Args: ip_address: Target IP address to investigate. earliest_time: Time window to scan (default '-24h@h'). count: Maximum events to return.

Audit user actions, accessed resources, IP origins, and privilege usage.

Args: username: Target username. earliest_time: Time range to audit. count: Maximum results.

Investigate system logs, processes, network connections, and errors for a host.

Args: hostname: Target host name or FQDN. earliest_time: Earliest search window. count: Maximum events.

Search for Indicators of Compromise (hashes, domains, IPs, URLs) across all indexed data.

Args: ioc_value: The IOC string (e.g. SHA256 hash, malicious domain, external IP). ioc_type: Optional type description ('hash', 'ip', 'domain'). earliest_time: Time range (default '-7d@d').

Correlate multi-source events occurring within a synchronized time window around an entity.

Args: entity_value: Target identifier (e.g. IP, username, hostname). window_minutes: Time window in minutes before and after timestamp. timestamp: Anchor epoch or ISO timestamp (default current time).

Execute statistical anomaly detection (outliers based on standard deviation) over time series.

Args: index: Index to inspect. sourcetype: Optional sourcetype. field_to_analyze: Metric or field (default 'count'). time_span: Aggregation bucket (default '1h').

Query security alerts, high-severity trigger events, and findings.

Args: severity: Optional severity filter ('critical', 'high', 'medium'). earliest_time: Time window (default '-24h@h'). count: Maximum alert items.

Composite tool: construct a high-fidelity chronological timeline for an incident entity.

Args: entity_type: Type of entity ('ip', 'user', or 'host'). entity_value: The entity string (e.g. '10.0.0.5', 'jsmith', 'srv-db-01'). earliest_time: Incident timeline start. latest_time: Incident timeline end. max_events: Maximum chronological timeline events.

Inspect search head performance, execution times, and resource utilization.

Args: earliest_time: Search audit window (default '-4h').

Identify slow or expensive searches exceeding duration threshold.

Args: min_duration_seconds: Threshold in seconds to flag (default 30). earliest_time: Search window. count: Maximum slow searches to list.

Inspect active concurrent historical and real-time searches against system limits.

Inspect search scheduler health, skipped searches, delayed executions, and quota blocks.

Args: earliest_time: Scheduler audit window (default '-4h').

Query recent internal daemon errors and warnings from index=_internal.

Args: log_level: Log severity filter ('ERROR', 'WARN', 'FATAL'). earliest_time: Time window (default '-4h'). count: Maximum errors to return.

Retrieve daily license quota, consumed bytes, warnings, and pool allocations.

Inspect filesystem disk partitions, storage volume in $SPLUNK_DB, and retention capacities.

Check health status of indexer cluster or search head cluster (or report standalone topology).

Check bucket replication status, cluster fix-up tasks, and peer synchronizations.

Composite tool: multi-dimensional assessment of CPU, memory, scheduler, disk, and search latency.

Create a new Splunk index with storage capacity and retention limits (requires write mode).

Args: name: Unique name of the new index. max_size_mb: Maximum index size in Megabytes (default 10,000 MB). frozen_retention_days: Optional retention window in days before aging to frozen.

Update settings, quotas, or disable/enable an index (requires write mode).

Args: name: Name of index to update. max_size_mb: Optional new maximum size in Megabytes. frozen_retention_days: Optional new retention in days. disabled: Set index disabled or enabled.

Enable or disable a configured data input stanza (requires write mode).

Args: input_type: Type of input (e.g. 'monitor', 'tcp/raw', 'http'). name: Name or port of the input stanza. action: 'enable' or 'disable'.

Create, update, or remove a Splunk user (requires write mode and human confirmation).

Args: username: Target username. action: 'create', 'update', or 'delete'. roles: List of roles to assign (e.g. ['user', 'power']). password: User password for creation/update (scrubbed from audit logs). realname: Optional display real name. email: Optional email address. confirm: Confirmation flag for user management.

Create, modify, or delete a security role (requires write mode and human confirmation).

Args: role_name: Role identifier. action: 'create', 'update', or 'delete'. capabilities: List of granted capabilities. allowed_indexes: Allowed searchable indexes. confirm: Confirmation flag.

Enable or disable a Splunk application (requires write mode and human confirmation).

Args: app_name: Target app folder name. action: 'enable' or 'disable'. confirm: Confirmation flag.

Audit and validate a configuration file for syntax errors or stanza duplicates.

Args: conf_file: Configuration file name (e.g. 'props', 'transforms', 'inputs').

Export search results in structured format (JSON, CSV, or raw events).

Args: spl: SPL search query. output_format: 'json', 'csv', or 'raw'. earliest_time: Optional earliest time. count: Maximum count of events to export.

Submit a synthetic test log event into a Splunk index via receiver endpoint (requires write mode).

Args: event_data: Raw log text or JSON payload. index: Destination index (default 'main'). sourcetype: Sourcetype marker. host: Optional origin host string.

Replay and re-execute a saved search query over a custom historical time range.

Args: name: Saved search name. earliest_time: Historical start time (e.g. '-7d@d', '1710000000'). latest_time: Historical end time (e.g. 'now', '-1d@d').

Convert natural language questions or operational requirements into secure, optimized SPL.

Args: prompt: User's analytical goal (e.g. 'top 10 IP addresses by failed login count'). target_index: Optional target index hint (e.g. '_audit', 'main', 'firewall'). time_range: Intended time window (default '-24h@h').

Analyze an SPL query, detect performance anti-patterns, and generate an optimized version.

Args: spl: SPL search string to optimize.

Interpret search results, highlight statistical distributions, and summarize key findings.

Args: results: Array of result dictionaries from a search. question: Optional analytical question being answered.

Compare event volume or metric values between two distinct time periods.

Args: metric_spl: Search query ending in stats count or metric. period1_earliest: Current period start. period1_latest: Current period end. period2_earliest: Comparison period start. period2_latest: Comparison period end.

Audit an index and sourcetype for null values, timestamp skew, and format discrepancies.

Args: index: Index to audit. sourcetype: Optional sourcetype filter.

Generate an executive Markdown operational health report covering license, errors, and storage.

Execute an automated investigation or operational workflow pipeline.

Args: workflow_name: Workflow to run ('incident_triage', 'ingestion_audit', 'capacity_review'). parameters: Workflow specific parameters (e.g. {'entity': '10.0.0.1'}).

Preview the impact of a configuration or administrative modification before executing it.

Args: operation: Operation type (e.g. 'update_index', 'delete_saved_search', 'modify_role'). target: Target resource identifier. proposed_settings: Proposed parameter values to evaluate.

Query recent MCP server tool invocations, execution duration, and audit logs.

Args: limit: Number of audit records to retrieve (default 50). tool_filter: Optional tool name filter. only_failures: Only retrieve failed tool executions.

Verify end-to-end connectivity, TLS, authentication, server version, and operational permissions.