Splunk MCP Server by CData

What is Splunk MCP Server by CData?

Splunk MCP Server by CData is a read-only Model Context Protocol (MCP) server that allows large language models (like Claude Desktop) to query live Splunk data using natural language. It wraps the CData JDBC Driver for Splunk, which exposes Splunk as relational SQL models, so no SQL knowledge is required from the user.

How to use Splunk MCP Server by CData?

Clone the repository, build with mvn clean install, download and install the CData JDBC Driver for Splunk, license the driver, configure the connection string using the driver’s utility, and create a .prp file with the connection details. Then configure your MCP client (e.g., Claude Desktop) by adding the server entry to the client’s config file, pointing to the built JAR and the .prp file.

Key features of Splunk MCP Server by CData

• Read-only access to live Splunk data via natural language queries
• Exposes tools: {servername}_get_tables, {servername}_get_columns, {servername}_run_query
• No SQL required for end users
• Relies on the CData JDBC Driver for Splunk for connectivity
• Supports all versions of Splunk accessible via the JDBC driver
• Uses stdio transport, so client and server must run on the same machine

Use cases of Splunk MCP Server by CData

• Ask an LLM about correlations in Splunk data (e.g., closed won opportunities by account industry)
• Query open tickets or support issues from Splunk in natural language
• Retrieve calendar events or other Splunk log data without writing SQL

FAQ from Splunk MCP Server by CData

Is this server read-only?

Yes, this MCP server is read-only. For full read, write, update, delete, and action capabilities, use the free CData MCP Server for Splunk (beta) linked in the README.

What are the runtime requirements?

You need Java, Maven, and the CData JDBC Driver for Splunk installed and licensed. The server runs as a JAR file and communicates via stdio.

Where does my data live?

Data remains in Splunk; the MCP server queries it live through the JDBC driver. No local copy is made.

What transport does the server use?

The server uses stdio transport, so it must run on the same machine as the MCP client.

What authentication is supported?

Authentication depends on the JDBC driver’s connection string, which can include OAuth, basic auth, or token-based methods as supported by Splunk.