Skip to main content
Glama
nks1097

Splunk Enterprise MCP Server

by nks1097

splunk_list_saved_searches

List saved searches, scheduled reports, and alerts in Splunk, optionally scoped to an app, with count and offset pagination for browsing results.

Instructions

List saved searches, scheduled reports, and alerts.

Args: app: Optional Splunk app context (e.g. 'search'). count: Number of saved searches to list. offset: Pagination offset.

Input Schema

NameRequiredDescriptionDefault
appNo
countNo
offsetNo

Output Schema

NameRequiredDescriptionDefault
dataNoOutput payload or results
errorNoError message if execution failed
successNoWhether the tool execution succeeded
metadataNoExecution timing, pagination and environment details
warningsNoOperational warnings or notices
request_idNoCorrelation ID for audit trail and observability

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv1.0.0

TDQS

B3.3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must carry the behavioral burden. The word 'List' implies a read-only operation and the parameter docs mention pagination, but permissions, default limits, and any app-context behavior are not described.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is short and front-loaded, with the purpose stated first and parameters documented directly afterward. Every sentence contributes to understanding the call, with no extraneous text.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple list tool with an output schema, the core purpose and parameters are present. However, with zero annotation coverage and zero schema description coverage, the description should say more about read-only behavior, pagination defaults, and how results relate to dedicated alert and report list tools.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It names all three parameters and adds brief meaning such as 'Optional Splunk app context' and 'Pagination offset', but does not explain count limits, default values beyond the schema, or precise app scoping.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific list operation over saved searches, scheduled reports, and alerts. It is clear what the tool does, but it does not distinguish itself from sibling tools such as splunk_list_alerts or splunk_list_reports, which appear to overlap in scope.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives no guidance on when to use this tool instead of splunk_list_alerts, splunk_list_reports, or splunk_get_saved_search. There are no exclusions, prerequisites, or alternative-selection criteria.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools