Allows searching, managing, and analyzing data in Splunk instances, including executing SPL queries, managing indexes, alerts, saved searches, dashboards, knowledge objects, KV store, data inputs, users and roles, apps, and server operations.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@mcp-server-splunk Search for errors in the last hour"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Search and manage Splunk from Pi, Claude Code, and Codex using MCP.
Install uv, then run one of these Bash examples. Replace localhost with your Splunk hostname.
Token:
export SPLUNK_HOST=localhost
read -rsp 'Splunk token: ' SPLUNK_TOKEN; echo
export SPLUNK_TOKENCreate a token in Splunk Web: Settings → Tokens → New Token.
Or username/password:
export SPLUNK_HOST=localhost
unset SPLUNK_TOKEN
export SPLUNK_USERNAME=your-username
read -rsp 'Splunk password: ' SPLUNK_PASSWORD; echo
export SPLUNK_PASSWORDLaunch your client from the same terminal. Restart it if it is already running.
Related MCP server: MCP Server for Splunk
pi mcp add splunk -- uvx mcp-server-splunk@latest
pi mcp list
piclaude mcp add --transport stdio --scope user splunk -- uvx mcp-server-splunk@latest
claude mcp list
claudeAdd to ~/.codex/config.toml:
[mcp_servers.splunk]
command = "uvx"
args = ["mcp-server-splunk@latest"]
env_vars = [
"SPLUNK_HOST", "SPLUNK_PORT", "SPLUNK_SCHEME",
"SPLUNK_TOKEN", "SPLUNK_USERNAME", "SPLUNK_PASSWORD",
]codex mcp list
codexVariable | Default | Purpose |
|
| Splunk hostname, without scheme or port |
|
| Management API port |
|
|
|
| — | Authentication token |
| — | Username when not using a token |
| — | Password when not using a token |
Use a token or username/password. A token takes precedence if both are set. The server does not load .env files automatically.
91 tools cover searches, indexes, alerts, saved searches, dashboards, lookups, macros, KV Store, inputs, users, roles, apps, and server administration. See tool definitions for parameters and behavior.
Some tools modify or delete Splunk resources. Use an account with only the permissions you need.
With connection variables set as above:
git clone https://github.com/pahar0/mcp-server-splunk.git
cd mcp-server-splunk
uv sync
uv run mcp-server-splunkThis server cannot be deployed
A comprehensive Model Context Protocol (MCP) server that enables AI assistants to interact with yo…
Query your Logspot analytics, companies, and revenue from any AI assistant, and run your actions.
Manage uptime monitors and incidents and search logs, metrics and traces from an AI assistant.
Query application logs, traces, and metrics from your AI coding assistant via Foam's MCP server.
