MCP Server for Splunk

What is MCP Server for Splunk?

MCP Server for Splunk is a Go implementation of the Model Context Protocol server that connects AI assistants (e.g. Cursor) to Splunk. It exposes tools to list saved searches, alerts, fired alerts, indexes, and macros, and supports STDIO and SSE (Server-Sent Events) transports.

How to use MCP Server for Splunk?

Set the SPLUNK_URL and SPLUNK_TOKEN environment variables. Run in STDIO mode (default) or SSE mode using the -transport sse and -port flags. Send JSON-RPC requests to invoke tools. Alternatively, build a Docker image or deploy via Smithery. Cursor users configure the server in ~/.cursor/mcp.json.

Key features of MCP Server for Splunk

• list_splunk_saved_searches – List saved searches with pagination.
• list_splunk_alerts – Query alerts, optionally filtered by title.
• list_splunk_fired_alerts – Retrieve fired alerts with time range filter.
• list_splunk_indexes – List Splunk indexes.
• list_splunk_macros – List Splunk macros.
• Includes a prompt to find alerts by keyword and a resource from a local CSV file.

Use cases of MCP Server for Splunk

• Query Splunk indexes and macros during AI‑assisted troubleshooting.
• Review recent fired alerts and filter by search name or time.
• List saved searches and alerts to understand the Splunk environment.
• Use in Cursor chat to answer questions like “How many Splunk indexes do we have?”.
• Integrate Splunk data directly into an LLM context via MCP.