MCP Server for Splunk

What is MCP Server for Splunk?

MCP Server for Splunk is a Go implementation of the Model Context Protocol server that connects AI assistants (e.g. Cursor) to Splunk. It exposes tools to list saved searches, alerts, fired alerts, indexes, and macros, and supports STDIO and SSE (Server-Sent Events) transports.

How to use MCP Server for Splunk?

Set the SPLUNK_URL and SPLUNK_TOKEN environment variables. Run in STDIO mode (default) or SSE mode using the -transport sse and -port flags. Send JSON-RPC requests to invoke tools. Alternatively, build a Docker image or deploy via Smithery. Cursor users configure the server in ~/.cursor/mcp.json.

Key features of MCP Server for Splunk

• list_splunk_saved_searches – List saved searches with pagination.
• list_splunk_alerts – Query alerts, optionally filtered by title.
• list_splunk_fired_alerts – Retrieve fired alerts with time range filter.
• list_splunk_indexes – List Splunk indexes.
• list_splunk_macros – List Splunk macros.
• Includes a prompt to find alerts by keyword and a resource from a local CSV file.

Use cases of MCP Server for Splunk

• Query Splunk indexes and macros during AI‑assisted troubleshooting.
• Review recent fired alerts and filter by search name or time.
• List saved searches and alerts to understand the Splunk environment.
• Use in Cursor chat to answer questions like “How many Splunk indexes do we have?”.
• Integrate Splunk data directly into an LLM context via MCP.

FAQ from MCP Server for Splunk

What runtime and dependencies does MCP Server for Splunk require?

The server is written in Go and uses the github.com/mark3labs/mcp-go SDK. You need Go to build it, or you can use the provided Dockerfile.

How does authentication work?

Authentication is handled via a Splunk token set in the SPLUNK_TOKEN environment variable.

Which transports are supported?

STDIO mode (default) and SSE (Server-Sent Events over HTTP) are both supported.

Where does the data come from?

All data is fetched live from the configured Splunk instance. No local database is used; the only local resource is an optional CSV file provided as an MCP resource.

Are there any limits on the number of results?

Yes, each tool that returns a list has a count parameter with a maximum of 100 results. Default values vary by tool (e.g. list_splunk_saved_searches defaults to 100, while list_splunk_alerts defaults to 10).