Provides tools for interacting with Splunk Enterprise, enabling searches, retrieving indexes, knowledge objects, user information, and error logs.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@splunk-mcp-server search for errors in the last 24 hours"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
A lightweight, extensible Model Context Protocol (MCP) server for Splunk Enterprise, designed to integrate with Claude Desktop or any MCP-compatible agent. Enables secure, async, chat-based interaction with your Splunk data using FastMCP.
get_knowledge_objects
search_splunk
get_splunk_indexes
get_log_stats
get_all_users
get_user_info
search_errors
Related MCP server: Splunk MCP Server
⚡ Async HTTP client via httpx
🧩 Simple plugin-style architecture for adding tools
💻 Designed for local development or integration with Claude Desktop
🚀 Built with FastMCP and Python 3.13
Download and install from Anthropic Claude Desktop (macOS only for now).
uv (Python package manager by Astral)sudo curl -LsSf https://astral.sh/uv/install.sh | env UV_INSTALL_DIR="/opt" sh
git clone https://github.com/balajifunny/splunk-mcp-server.git
cd splunk-mcp-server
Update the Splunk configuration section in main.py
SPLUNK_HOST=127.0.0.1
SPLUNK_PORT=8089
SPLUNK_USERNAME=<your_splunk_username>
SPLUNK_PASSWORD=<your_splunk_password>
SPLUNK_SCHEME=https~/Library/Application Support/Claude/claude_desktop_config.json
{
"mcpServers": {
"splunk-mcp-demo": {
"command": "/opt/uv",
"args": [
"run",
"--with",
"mcp[cli]",
"mcp",
"run",
"/Users/<your_user_name>/splunk-mcp-server/main.py"
]
}
}
}
Fetch all Splunk users.
Inputs: no named parameters. Returns: result
Get knowledge objects from Splunk. Supported types include saved_searches, lookups, macros, etc.
Inputs: type (required), count.
Get log statistics for a specific index.
Inputs: index (required), time_range. Returns: result
Get list of available Splunk indexes.
Inputs: no named parameters. Returns: result
Get detailed information about a specific Splunk user.
Inputs: username (required). Returns: result
Search for error logs across indexes.
Inputs: index, time_range, max_count. Returns: result
Search Splunk logs with the given query.
Inputs: query (required), earliest_time, latest_time, max_count. Returns: result
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Scored across 7 tools
Each tool targets a distinct resource or operation: users (all vs specific), indexes, knowledge objects, log statistics, general search, and error search. No overlapping purposes.
Most tools follow 'get_' prefix (5 tools), but two use 'search_' prefix. There is a clear verb_noun pattern, though the verb varies between get and search.
7 tools is well-scoped for a Splunk MCP server, covering essential read and search operations without being excessive or minimal.
The toolset covers core retrieval and search operations, but lacks create/update/delete for knowledge objects and users, which are common Splunk operations.
MCP server unifying ERPs, CRMs, APIs and knowledge base for Claude, ChatGPT and Gemini.
An MCP server that provides an API to LLMs to manage their JumpCloud resources.
Hosted Slack MCP server for Claude, ChatGPT and Cursor, with each action switched per account.
Talk to your public-facing AI from any MCP client — Claude, ChatGPT, Cursor, Cline, Windsurf.
