Splunk MCP Server

What it is

The official MCP server built by Splunk for Enterprise and Cloud Platform deployments. It exposes Splunk's search and metadata surface to AI assistants over the Model Context Protocol, so an agent can explore indexes, generate SPL and run searches without anyone writing a bespoke integration.

The deployment model is the interesting part

Unlike most vendor MCP servers, this one is not a separate process you run next to Splunk and point at an API token. It is installed into the Splunk instance itself and served over the management port — by default https://<SPLUNK_HOST>:8089/services/mcp — as an HTTP/SSE endpoint. Configuration lives in mcp.conf and authorize.conf alongside the rest of your Splunk config.

That has a direct consequence for access control: requests inherit the caller's existing Splunk authentication and role-based access control rather than running under a shared service identity. An analyst's agent sees the indexes that analyst can already see. For a system that typically holds an organisation's security and audit logs, that is the difference between an MCP server security will approve and one it will not. The server also does input validation against malicious payloads and command injection, and writes to Splunk's audit log.

Tools

• generate_spl — turn a natural-language question into an SPL query
• run_splunk_query — execute an SPL search and return results
• get_splunk_info, get_indexes, get_index_info — explore what data is available
• get_saved_searches — discover existing knowledge objects

The pairing of generate_spl with index discovery is what makes this useful in practice: SPL is the main barrier to ad-hoc Splunk work for people who are not daily users, and an agent that can enumerate the indexes first has enough grounding to write a query that actually runs.

Before you deploy

Version 1.0.1, released February 2026, carrying "Splunk Supported · Beta" status — supported by Splunk but not yet generally available, so treat it accordingly in production. It covers Splunk platform versions 8.0 through 10.2 across both Enterprise and Cloud. Licensed under Splunk General Terms rather than an open-source licence. The repository is published under the CiscoDevNet organisation following Cisco's acquisition of Splunk.